WO2021077987A1 - 一种安全漏洞的防御方法和设备 - Google Patents

一种安全漏洞的防御方法和设备 Download PDF

Info

Publication number
WO2021077987A1
WO2021077987A1 PCT/CN2020/117834 CN2020117834W WO2021077987A1 WO 2021077987 A1 WO2021077987 A1 WO 2021077987A1 CN 2020117834 W CN2020117834 W CN 2020117834W WO 2021077987 A1 WO2021077987 A1 WO 2021077987A1
Authority
WO
WIPO (PCT)
Prior art keywords
vulnerability
asset
information
identifier
network
Prior art date
Application number
PCT/CN2020/117834
Other languages
English (en)
French (fr)
Inventor
蒋武
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP20880280.1A priority Critical patent/EP4027604A4/en
Priority to JP2022521014A priority patent/JP7299415B2/ja
Publication of WO2021077987A1 publication Critical patent/WO2021077987A1/zh
Priority to US17/717,751 priority patent/US20220239687A1/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1433—Vulnerability analysis
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/101—Access control lists [ACL]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general

Definitions

  • This application relates to the field of network security, and in particular to a method and equipment for defending against security breaches.
  • Security vulnerabilities also known as vulnerabilities (Vulnerability) refer to deficiencies in computer system security that threaten the confidentiality, integrity, availability, and access control of the computer system or its application data.
  • the above-mentioned defects include computer hardware, software, and computer defects in the specific implementation of communication protocols or security policies.
  • the existing technology uses vulnerability scanning technology to monitor and scan the network, and discover the security vulnerabilities in the network in time.
  • vulnerability scanning software scans key network devices in the network, and reports information such as security vulnerabilities and security configuration levels of network devices found during the scanning process to the network management system.
  • the network management system issues security patches to corresponding network devices according to the received scanning results, so as to repair the loopholes in the network devices.
  • the network management system itself stores security patches, or the network management system obtains security patches from a third-party security patch provider through the network based on the vulnerability model. For example, for security vulnerabilities found in application software, the network management system downloads corresponding patches from the technical support website of the application software development manufacturer based on the version of the application software.
  • the embodiments of the present application provide a method and equipment for defending against security vulnerabilities, which are used to improve the timeliness of emergency response and defense of the network and reduce the possibility of attacks on the network.
  • a defense method for security vulnerabilities includes obtaining asset information of assets of a first network device by a vulnerability management device, the asset information includes asset identification, asset model, and asset version, the first network device is located within a controlled network; the vulnerability management device Based on the asset model and asset version in the asset information, the vulnerability information corresponding to the asset information is obtained; the vulnerability management device determines the vulnerability response playbook corresponding to the vulnerability information, and the vulnerability response playbook is used to be used by After the analysis, the vulnerability defense strategy for the first network device is executed.
  • the embodiment of the present application takes advantage of the quick and flexible development of the vulnerability response playbook compared to the security patch, and provides a security vulnerability defense method based on the vulnerability response playbook.
  • the vulnerability management device obtains the corresponding vulnerability response playbook according to the security vulnerabilities of the assets on the network equipment in the controlled network, and further according to the obtained vulnerability response playbook, so as to implement the vulnerability defense strategy on the network equipment.
  • This method is used for emergency treatment and defense of the network through automated response before security patches are available, for example, software developers or third-party security patch providers have not issued security patches or effective security strategies for network security vulnerabilities, so as to avoid the network Under attack, the robustness and security of the network are improved.
  • the acquiring vulnerability information corresponding to the asset information includes that the vulnerability management device is based on the asset model and asset version in the asset information.
  • the vulnerability management device is based on the correspondence between the combination of the asset model and asset version and the vulnerability information, and
  • the asset identifier, asset model, and asset version in the asset information determine the correspondence between the asset identifier and vulnerability information.
  • the corresponding relationship between asset identification and vulnerability information is determined, so that the network devices that need to implement the vulnerability defense strategy can be determined subsequently to ensure the accuracy of vulnerability defense.
  • the vulnerability management device determining the vulnerability response script playbook corresponding to the vulnerability information includes: the vulnerability management device based on the correspondence between the asset identifier and the vulnerability information, and the vulnerability information Correspondence with the vulnerability response playbook, determine the vulnerability response playbook corresponding to the asset identifier in the asset information; use the determined vulnerability response playbook as the vulnerability response corresponding to the vulnerability information playbook.
  • the vulnerability management device parses the vulnerability response playbook to obtain the vulnerability defense strategy; the vulnerability management device sends a notification to the first network based on the asset identifier in the asset information The device sends the vulnerability defense strategy, so that the first network device executes the vulnerability defense strategy.
  • the vulnerability management device can directly send the vulnerability response playbook to the first network device, and the vulnerability response playbook is parsed by the first network device to obtain the vulnerability defense strategy and execute the vulnerability defense strategy. In this way, the vulnerability management device omits the step of analyzing the vulnerability response playbook, and reduces the processing load of the vulnerability management device.
  • the first network device needs to support the function of analyzing the vulnerability response playbook, which requires higher performance of the first network device.
  • the vulnerability management device may also parse the vulnerability response playbook to obtain the vulnerability defense strategy, and then send the vulnerability defense strategy to the first network device.
  • the vulnerability management device executes the step of analyzing the vulnerability response playbook, which will increase the processing load of the vulnerability management device, but the first network device does not need to support the function of analyzing the vulnerability response playbook, and the performance requirement of the first network device is low.
  • one of the above two methods can be flexibly selected according to the hardware conditions of the network equipment and vulnerability management equipment.
  • the asset identifier in the asset information is a global asset identifier
  • the global asset identifier includes the device identifier of the first network device
  • the global asset identifier is in the controlled network It is unique within a range.
  • the method further includes obtaining the device identifier of the first network device included from the global asset identifier; Sending the vulnerability prevention strategy to the first network device specifically includes sending the vulnerability prevention strategy to the first network device according to the device identifier of the first network device.
  • the vulnerability management device parses the vulnerability response playbook to obtain the vulnerability defense strategy; sends the vulnerability defense strategy to a forwarding device related to the first network device, so that The forwarding device related to the first network device executes the vulnerability defense strategy.
  • the method before the sending the vulnerability defense strategy to the forwarding device related to the first network device, the method further includes the vulnerability management device obtaining the device identification of the first network device , And network topology information of the controlled network; the vulnerability management device determines the forwarding device related to the first network device based on the network topology information.
  • the vulnerability prevention strategy can be implemented on the forwarding device related to the network device to isolate the data and devices at risk for the network device to prevent the network device from being damaged. attack.
  • the vulnerability management device obtains the device identifier of the first network device, specifically: the vulnerability management device obtains the first network device based on the asset identifier in the asset information The device identifier of the device, wherein the asset identifier is a global asset identifier, the global asset identifier includes the device identifier of the first network device, and the global asset identifier is within the scope of the controlled network Is unique, the vulnerability management device obtains the device identifier of the first network device based on the global asset identifier, or the asset identifier is a local asset identifier, and the local asset identifier is in the first It is unique within the network device, and the vulnerability management device obtains the device identifier of the first network device based on the correspondence between the local asset identifier and the device identifier.
  • the vulnerability prevention strategy includes an access control strategy based on an access control list ACL, a regular filtering strategy based on a signature string, and/or an intrusion prevention system IPS protection signature strategy.
  • a vulnerability management device in the second aspect, includes a first obtaining unit for obtaining asset information of assets of a first network device, where the asset information includes an asset identifier, an asset model, and an asset version, and the first network device is located within a controlled network;
  • the second obtaining unit is used to obtain the vulnerability information corresponding to the asset information based on the asset model and the asset version in the asset information;
  • the first determining unit is used to determine the vulnerability response script playbook corresponding to the vulnerability information,
  • the vulnerability response playbook is used to execute a vulnerability defense strategy for the first network device after being parsed.
  • the second obtaining unit obtains vulnerability information corresponding to the asset information, including based on the asset model and asset version in the asset information, in the combination and vulnerability of the asset model and asset version.
  • the vulnerability information corresponding to the asset model and asset version in the asset information is found; based on the correspondence between the combination of the asset model and asset version and the vulnerability information, and the vulnerability information in the asset information.
  • the first determining unit determines the vulnerability response script playbook corresponding to the vulnerability information, including the corresponding relationship based on the asset identifier and the vulnerability information, and the vulnerability information and the vulnerability response
  • the correspondence relationship of the playbook is to determine the vulnerability response playbook corresponding to the asset identifier in the asset information; the determined vulnerability response playbook is used as the vulnerability response playbook corresponding to the vulnerability information.
  • the device further includes a parsing unit, configured to parse the vulnerability response playbook to obtain the vulnerability defense strategy; and a sending unit, configured to send information based on the asset identifier in the asset information The first network device sends the vulnerability defense strategy, so that the first network device executes the vulnerability defense strategy.
  • the asset identifier in the asset information is a global asset identifier
  • the global asset identifier includes the device identifier of the first network device
  • the global asset identifier is in the controlled network
  • the device is unique within the range.
  • the device further includes the first acquiring unit acquiring the first data included in the global asset identifier from the global asset identifier.
  • the device identification of the network device; the sending unit sending the vulnerability defense strategy to the first network device is specifically: sending the vulnerability defense to the first network device according to the device identification of the first network device Strategy.
  • the device further includes a parsing unit, configured to parse the vulnerability response playbook to obtain the vulnerability defense strategy; and a sending unit, configured to send all data to the forwarding device related to the first network device The vulnerability defense strategy, so that the forwarding device related to the first network device executes the vulnerability defense strategy.
  • the device before the sending unit sends the vulnerability prevention policy to a forwarding device related to the first network device, the device further includes the first obtaining unit to obtain the first network device And the network topology information of the controlled network; the second determining unit is configured to determine the forwarding device related to the first network device based on the network topology information.
  • the vulnerability prevention strategy can be implemented on the forwarding device related to the network device to isolate the data and devices at risk for the network device to prevent the network device from being damaged. attack.
  • the first acquiring unit acquires the device identifier of the first network device, specifically: acquiring the device identifier of the first network device based on the asset identifier in the asset information A device identifier, wherein the asset identifier is a global asset identifier, the global asset identifier includes the device identifier of the first network device, and the global asset identifier is unique within the scope of the controlled network,
  • the first acquiring unit acquires the device identifier of the first network device based on the global asset identifier, or the asset identifier is a local asset identifier, and the local asset identifier is in the first network device Is unique, and the first acquiring unit acquires the device identifier of the first network device based on the correspondence between the local asset identifier and the device identifier.
  • the vulnerability prevention strategy includes an access control strategy based on an access control list ACL, a regular filtering strategy based on a signature string, and/or an intrusion prevention system IPS protection signature strategy.
  • a vulnerability management device including a processor and a memory, the memory is used to store a computer program, and the processor is used to call the computer program stored in the memory to execute any of the possible designs described in the first aspect The corresponding method.
  • a computer-readable storage medium stores a computer program for executing the corresponding method described in any possible design in the first aspect.
  • a computer program product containing instructions which when run on a computer, causes the computer to execute the method described in the first aspect or any one of the possible implementations of the first aspect.
  • an embodiment of the present application provides a chip including a memory and a processor, the memory is used to store computer instructions, and the processor is used to call and run the computer instructions from the memory to execute the first aspect and its first The method in any possible implementation of the aspect.
  • Figure 1 is a schematic structural diagram of a vulnerability management system provided in a technical solution
  • FIG. 2 is a schematic diagram of a network system structure for implementing network vulnerability defense provided by an embodiment of the application
  • FIG. 3 is a schematic flowchart of a security vulnerability defense method provided by an embodiment of the application.
  • FIG. 4 is a schematic structural diagram of a vulnerability management device provided by an embodiment of the application.
  • Figure 5 is a schematic structural diagram of another vulnerability management device provided by an embodiment of the application.
  • FIG. 1 is a schematic structural diagram of a vulnerability management system 100 provided in a related technical solution, which is used to implement vulnerability scanning and patch repair of a host.
  • the vulnerability management system 100 includes a host device 106 and a vulnerability management server 101.
  • the vulnerability management server 101 includes a vulnerability scanner 104 and a patch management module 102.
  • the vulnerability scanner 104 and the patch management module 102 are implemented by software.
  • the vulnerability scanner is the vulnerability scanner NESSUS launched by Tenable, or the open source scanning tool Nmap, or the network tool netcat on the Unix operating system platform.
  • the patch management module is SolarWinds launched by SolarWinds, or software modules developed by other network management parties.
  • the above-mentioned vulnerability scanner 104 and patch management module 102 can be integrated into the NetView network management system launched by IBM, or the network management system OpenView launched by HP.
  • the host device 106 may be, for example, a user device such as a smart terminal, a tablet computer, or a desktop computer, or may be an enterprise-level network management device.
  • the vulnerability scanner 104 can monitor and scan the host device 106 through the network to find various security vulnerabilities in the host device 106, such as system vulnerabilities, security software vulnerabilities, or application software vulnerabilities.
  • the vulnerability scanner 104 sends the discovered vulnerability information of the host device 106 to the patch management module 102.
  • the patch management module 102 determines whether there is patch information for patching the corresponding vulnerability based on the vulnerability information, and if there is corresponding patch information, it delivers to the host device 106.
  • the host device 106 includes a patching unit 108, and the patching unit 108 patches the host device through patch information received by the host device 106 to repair system vulnerabilities.
  • the interaction between devices or units of the vulnerability management system 100 can be seen in steps s105-s120 in FIG. 1.
  • the vulnerability management system 100 can remotely monitor and repair the security vulnerabilities of the host device 106, thereby reducing the risk of the network host being attacked to a certain extent.
  • network vulnerabilities will also affect other key network devices in the network on a large scale, such as servers and their software and hardware, routers, switches, and security. Firewalls, etc., at this time, only performing security scans on the host system still cannot effectively prevent network-wide vulnerabilities.
  • Fig. 2 is a schematic structural diagram of a network system for implementing security vulnerability defense provided by an embodiment of the present application.
  • the network system includes multiple host devices 214, multiple network security devices 212, a network management system 202, and a vulnerability management device 204.
  • the network security device 212 may be, for example, a device with a certain security defense capability in the network, such as a security gateway, firewall, router, or switch.
  • the host device 214 and/or the network security device 212 sends asset information of related assets on the device to the network management system 202, as shown in S205.
  • it may also be other types of devices in the network that need to perform vulnerability analysis and defense, and send asset information of related assets on the device to the network management system 202, which can be specifically determined in combination with actual application scenarios.
  • the assets include either or both of physical assets and logical assets.
  • the physical asset is a device in the network or the hardware or components on the device
  • the logical asset is the software running on the device in the network or the information stored by the device in the communication network.
  • physical assets include multi-core CPUs or solid state drive (Solid State Disk, SSD) arrays
  • logical assets include operating systems and software applications on defense devices in the network. The asset described is related to its model and version.
  • the same host device 214 its operating system and software application A running on the system belong to different assets, and software application A and software application B running on the same host system also belong to different assets; for another example, For a certain host device 214 that includes two virtual machines, although the same software application A runs on the two virtual machines, but because the versions of the software application A running on different virtual machines are different, the above two virtual machines are still changed. Two different versions of software application A are regarded as different assets. Two software applications of different models running on the two host devices 214 respectively belong to different assets, and two software applications of the same model but different versions running on the two host devices 214 also belong to different assets.
  • the asset can use asset identification to distinguish multiple assets of the same model and version.
  • the asset identifier may be a global asset identifier, which is unique within the scope of the controlled network and can uniquely identify a specific asset on a specific network device in the entire network.
  • the global asset identifier may include the device identifier of the network device of the asset.
  • the asset identifier may also be a local asset identifier, and the local asset identifier is unique within a specific network device, such as the host device 214 or the network security device 212, so as to at least ensure that it can be unique within the same network device. Identifies a specific asset.
  • the asset may be represented by asset information.
  • the asset information includes at least an asset identifier, an asset model, and an asset version.
  • the asset information is expressed as ⁇ asset identifier, asset model, asset version>.
  • Each network device such as the host device 214 or the network security device 212, can determine one or more assets that need to be defended against security vulnerabilities.
  • the network device may send asset information of assets that need to be defended against security vulnerabilities to the network management system 202.
  • the sending may be executed periodically according to a certain time period, or may be executed irregularly when a certain condition is met, for example, when a certain condition is triggered, for example, the number of vulnerabilities found within a certain period of time meets a threshold, or a key vulnerabilities list is hit, or vulnerabilities found The total number exceeds the preset value, etc.
  • the network device may send the asset information of each asset one by one, or may also send the asset information of multiple assets at once to improve the sending efficiency.
  • the specific scope of each sending can be determined according to actual needs. For example, it can include asset information of all assets that need to be tested for vulnerabilities, or preset according to the network management system 202. Rules, sending asset information of designated assets that conform to the preset rules, or sending asset information of some assets according to asset priority.
  • the one or more asset information sent each time constitute an asset information group.
  • the host device 214 may send the asset information group to the network management system 202,
  • an 8-bit binary code unique to the entire network can be used to represent the asset identifier, such as replacing "host device A-ZC1" with 10001001, and "host device A-ZC2" with 10001010.
  • an identifier correspondence table is created based on the combination of asset model and asset version. For example, "Office 2017, V1.0" corresponds to identifier 1001, and "Office 2017, V1.1" corresponds to identifier 1010.
  • ⁇ Host system A-ZC1, Office 2017, V1.0> can be expressed as ⁇ 10001001, 1001>
  • ⁇ Host system A-ZC2 Office 2017, V1.1> can be expressed as ⁇ 10001010, 1010>, which can save Bandwidth resources required to send asset information group data. It should be noted that no matter which specific asset information group expression form is adopted, it is necessary to ensure that the network management system 202 or other possible systems receiving the corresponding asset information understand the corresponding analysis rules.
  • the network management system 202 receives the asset information group sent by the host device 214. For a situation where one or more asset information in the asset information group includes a local asset identifier, or includes a global asset identifier without a device identifier, the network management system 202 determines the host device corresponding to the one or more asset information respectively 214 device identification. For a situation where one or more asset information includes a global asset identifier, and the global asset identifier includes the device identifier of the host device 214, the network management system 202 can obtain the device identifier from the global asset identifier without requiring other information to be the One or more asset information determines the device identification.
  • the network management system 202 also determines the network topology information of the host device 214, where the network topology information is address information and/or path information of other network devices related to the host device 214, and the other
  • the network device may be, for example, a forwarding device related to the host device 214, such as network security devices 212 such as network management firewalls, routers, and switches, to be used to directly send vulnerability emergency defense strategies to the network security device 212 related to the host device, at least to ensure The host device 212 is safe to use before installing the vulnerability patch.
  • the network topology information may be automatically obtained through the network management system 202, or may be manually configured by the network administrator after receiving the asset information group.
  • the network management system 202 sends the asset information group of the host device 214 and the corresponding network topology information and/or device identification to the vulnerability management device 204.
  • the network management system 202 generates network topology information through a topology discovery mechanism.
  • the network devices targeted for vulnerability management include the host device 214 and the network security device 212.
  • the above implementation only uses the host device 214 as an example, but it is understandable that the network security device 212 can also send the asset information group of the network security device 212 and the corresponding network topology information and/or to the vulnerability management device 204 in a similar manner. Or device identification.
  • the device identification of the host device 214 or the network security device 212 that sends the asset information group may be carried by the host device 214 or the network security device 212 itself and sent to the network management system 202; or The network management system 202 determines the corresponding device identification locally according to the relevant information of the host device 214 or the network security device 212 that sends the asset information group.
  • other devices in the network send asset information of the assets of the network device to the network management system 202.
  • a forwarding device related to the host device 214 such as a host device, is used to protect the host device.
  • the gateway firewall of the device 214, or a router or switch used to forward data to the host device 214 can sometimes also find the asset information on the host device 214 by reading and analyzing data packets to be sent to the host device 214.
  • other devices such as gateway firewalls, routers, and switches send asset information of the host device 214 to the network management system 202.
  • the network management system 202 may also send the network topology information of the entire network to the vulnerability management device 204, so that the vulnerability management device 204 can be associated with the asset information group according to The device identification of and the network topology information of the entire network determine the forwarding device 212 corresponding to the host device 214 that needs to execute the vulnerability prevention strategy.
  • the network management system 202 may periodically or irregularly update the network topology information for the vulnerability management device 204 to ensure that the vulnerability prevention strategy is executed based on the network topology information. Effectiveness and reliability.
  • the update may be a complete or partial update of the topology information of the entire network.
  • the vulnerability management device 204 includes an asset and vulnerability corresponding library 206, a vulnerability response script (English: playbook) unit 208, and an analysis and defense unit 210.
  • the asset and vulnerability correspondence library 206 is used to store the correspondence between assets and vulnerabilities.
  • the correspondence may be a one-to-one relationship or a one-to-many relationship, that is, an asset may include multiple vulnerabilities.
  • the correspondence between assets and vulnerabilities can be uniquely indexed by ⁇ asset model, asset version> in the asset information of the asset, that is, assets with the same asset version and asset model have the same correspondence with vulnerabilities. A possible representation of the correspondence between assets and vulnerabilities is given below.
  • the same vulnerability of different assets also has different vulnerability identifiers. For example, even if vulnerability 1 and vulnerability 4 have the same model, because of their If they belong to different assets, they also have different vulnerability identifiers, which can facilitate the management of asset vulnerabilities.
  • the multiple vulnerabilities may be Each vulnerability is assigned the same vulnerability identifier to save storage resources.
  • V1.0—Vulnerability 1, Vulnerability 2, Vulnerability 3> can also be expressed as ⁇ 1001—Vulnerability 1, Vulnerability 2, Vulnerability 3> , Or split ⁇ Office 2017, V1.0-Vulnerability 1, Vulnerability 2, Vulnerability 3> into ⁇ Office 2017, V1.0-Vulnerability 1>, ⁇ Office 2017, V1.0-Vulnerability 2> and ⁇ Office 2017, V1.0——Vulnerability 3>, or the vulnerabilities can be numbered according to some predefined rules, etc.
  • the specific expression method can be customized according to actual needs and scenarios.
  • the correspondence between ⁇ asset model, asset version> and vulnerabilities can be released by a third party such as software product manufacturers, hardware product manufacturers, or security vulnerability managers, and then received or received by the vulnerability management device 204. Download and save in the local asset and vulnerability corresponding library 206.
  • the third party publishes vulnerability prompt information for assets, and after receiving the vulnerability prompt information, the vulnerability management device 204 establishes the corresponding relationship between the corresponding asset and the vulnerability, and saves it in The local vulnerability corresponds to the library 206.
  • the asset and vulnerability corresponding library 206 may not be stored in the vulnerability management device 204, but set in other devices or the cloud for the vulnerability management device 204 to directly call or temporarily download, thereby improving the vulnerability management device 204's flexibility and real-time use.
  • the vulnerability response playbook unit 208 is used to store the vulnerability response playbook for the vulnerability.
  • a playbook is a language used to manage the configuration, deployment and orchestration of network elements in the network. This language can be used to arrange a series of logical operations for one or more network elements for analysis by the one or more network elements And execute.
  • the orchestration administrator can organize a set of playbooks that guide one or more network element devices to perform a series of specific operations, such as performing a series of actions related to security defense in accordance with the playbook.
  • the playbook allows the orchestration administrator to focus on the logic of the orchestration operation, and hides the programming interface that connects the various systems and the implementation of their instructions.
  • the emergency response playbook corresponding to the vulnerability that is, the playbook script of a set of emergency response actions prepared for the vulnerability, is used to execute the corresponding emergency defense strategy at the necessary stage to avoid the occurrence of the vulnerability in the window period.
  • the necessary stage may be, for example, before a vulnerability is discovered but a patch is not released, or the vulnerability patch is not sufficient to deal with a new attack method, a patch upgrade is required, or the vulnerability defense level needs to be improved in an extraordinary period or an extraordinary situation.
  • the scenarios listed above are only examples.
  • the specific scenario under which the playbook vulnerability defense strategy is activated can be set as required.
  • Specific emergency defense strategies can be selected and designed in combination with actual application scenarios, such as executing access control list (English: Access Control List, ACL) access control strategies, regular filtering strategies based on signature strings, and/or intrusion prevention systems (English: Intrusion Prevention System, IPS) protection signature strategy, etc.
  • the ACL access control strategy can be used to issue a list of instructions to router interfaces, etc., to instruct the router to accept or reject data packets.
  • the ACL command list can be used to restrict the router to only accept trusted data packets, so as to ensure that the router is not threatened by malicious data packets.
  • IPS protection signature strategy is mainly based on the collected historical vulnerability information and attack characteristics, etc., to establish and maintain characteristic behavior classification filters, such as gateway firewalls, which classify and inspect the network traffic flowing through, and use classification filters to detect and block intrusions Behaviors, such as application vulnerability attacks, Trojan horses, spyware, suspicious network operations (remote control, adware, etc.), etc.
  • the vulnerability response playbook unit 208 stores the correspondence between the vulnerability of the asset and the playbook.
  • the correspondence between the vulnerability and the playbook may be a one-to-one relationship, and the correspondence between the vulnerability and the playbook may be determined by ⁇ asset model, asset version, vulnerability identifier> is uniquely indexed, that is, for the same vulnerability identifier of the same asset, the corresponding relationship with the playbook is also the same.
  • the following shows a possible representation of the correspondence between vulnerabilities and playbooks.
  • the playbook scripts compiled for multiple different vulnerability identifiers are substantially the same, it can be considered that the multiple different vulnerability identifiers correspond to the same playbook, that is, multiple different assets
  • the correspondence between multiple vulnerabilities and playbooks can sometimes be a many-to-one relationship to save storage resources.
  • the playbook corresponding to the vulnerability can be published by the third party, so the vulnerability response playbook unit 208 may not be in the vulnerability management device 204, but set in other devices or the cloud for the vulnerability management device. 204 Direct call or temporary download.
  • the asset information of the asset can be expressed as ⁇ asset identification, asset model, asset version>, as shown in S215, the analysis and defense unit 210 can be based on the ⁇ asset model, asset version> in the asset information, And the corresponding relationship between assets and vulnerabilities ⁇ asset model, asset version, vulnerability identifier>, analyze and establish the corresponding relationship between asset identifier and vulnerability identifier, such as ⁇ asset identifier, asset model, asset version, vulnerability identifier>, or only match and Establish the corresponding relationship of ⁇ asset identification, vulnerability identification>.
  • the analysis and defense unit 210 may directly determine the network device of the asset based on the asset identifier, and establish a relationship between the specific asset on the network device and the vulnerability identifier.
  • the analysis and defense unit 210 also needs to determine the device identifier corresponding to the asset information that includes the asset identifier, thereby Determine the correspondence between specific assets and vulnerability identifiers on a network device.
  • the analysis and defense unit 210 may also obtain the network topology information of the host device 214 or the network security device 212 that sends the asset information of the asset to determine the forwarding device related to the host device 214 or the network security device 212.
  • the analysis and defense unit 210 can obtain a playbook script for emergency treatment and defense of the vulnerability through the vulnerability identification. As shown in S220, the analysis and defense unit 210 parses the determined playbook script to obtain a vulnerability defense strategy for handling asset vulnerabilities.
  • the asset identifier associated with the vulnerability identifier and the necessary device identifier in some of the foregoing situations, it is possible to know to which network device the analyzed vulnerability defense strategy needs to be sent and used to defend the network device The vulnerability in which asset.
  • the analysis and defense unit 210 may also send, based on the network topology information corresponding to the network device, to one or more forwarding devices related to the network device, the information used to defend against vulnerabilities obtained after analyzing the playbook script.
  • the forwarding device may be, for example, a network security device 212 related to the network device.
  • the host device 214 or the network security device 212 performs corresponding defense operations based on the received vulnerability defense strategy.
  • the analysis and defense unit 210 may not parse the playbook script, but directly send to the corresponding host device 214 or network security device 212, and the host device 214 or network security device 212 The device 212 parses the playbook script to execute the corresponding vulnerability defense strategy to ensure the operation safety of the network system.
  • the vulnerability management device 204 first sends a playbook script for repairing one or more security vulnerabilities to the network management system 202, and then the network management system 202 sends the playbook script to the host device 214 or the network security device 212 , Or the network management system 202 sends the vulnerability defense strategy generated after parsing the playbook script to the host device 214 or the network security device 212; or, the vulnerability management device 204 does not exist independently of the network management system 202, but serves as the network management system 202
  • the components are integrated to implement corresponding vulnerability analysis and defense functions; or, the vulnerability management device 204 can also be integrated in other devices or systems on the network.
  • FIG. 3 is a schematic flowchart of a security vulnerability defense method 300 provided by an embodiment of the application.
  • the method 300 may be executed by the vulnerability management device 204 in FIG. 2, or may be integrated in the network management system 202 or other network devices. Implementation of equipment or units that implement the corresponding vulnerability defense function.
  • the method 300 includes the following contents.
  • the vulnerability management device obtains asset information of the asset of the first network device, where the asset information includes an asset identifier, an asset model, and an asset version, and the first network device is located within a controlled network.
  • the vulnerability management device 204 obtains asset information of related assets in the network device.
  • the asset information of the assets of the network device may be obtained by the network device itself, or may be obtained by other devices in the network.
  • other devices related to the host device 214 such as a forwarding device, can read and analyze the data to be sent to the host device 214. Messages, etc., discover asset information corresponding to the assets on the host device 214.
  • the network device may be, for example, the network security device 212 or the host device 214 shown in FIG. 2. Taking a host device 214 as an example, it may include a key asset that needs vulnerability prevention.
  • the asset may be described by corresponding asset information, and the asset information may include asset identification, asset model, and asset version.
  • the asset information may also include other types of information, as long as information of sufficient dimensions can be used to distinguish different assets, and which information is specifically included can be determined according to actual application scenarios.
  • One host device 214 may also include multiple assets. In this case, the vulnerability management device 204 needs to obtain multiple sets of asset information corresponding to the multiple assets.
  • the asset identification is used to identify different assets, so as to quickly and specifically issue asset vulnerability defense strategies to corresponding network devices.
  • the asset identifier is a global asset identifier, and the global asset identifier is unique within the scope of the controlled network.
  • the global asset identifier includes the device identifier of the first network device.
  • the asset identifier is a local asset identifier, and the local asset identifier is unique within the first network device.
  • the device identification of the network device may be, for example, a device ID, an Internet Protocol (English: Internet Protocol, IP) address or a media access control (English: Media Access Control, MAC) address of the device, etc.
  • the device identification may be sent by the network security device 212 or the host device 214, or may be determined and added by the network management system 202 according to the sender information when receiving the asset information.
  • the vulnerability management device obtains vulnerability information corresponding to the asset information based on the asset model and asset version in the asset information.
  • the analysis and defense unit 210 of the vulnerability management device 204 may determine one or more vulnerabilities of the asset in the network device that need to be defended based on the correspondence between the assets of the network device and the vulnerabilities.
  • the asset and vulnerability correspondence library 206 can store the correspondence between the combination of ⁇ asset model, asset version> and vulnerabilities, and the correspondence may be a one-to-one relationship or a one-to-many relationship. That is, a combination of ⁇ asset model, asset version> corresponds to multiple vulnerabilities.
  • the expression form of the corresponding relationship between the ⁇ asset model, asset version> combination and the vulnerability can be ⁇ asset model, asset version—vulnerability identifier 1,..., vulnerability identifier N>, where N represents the asset information corresponding The number of vulnerabilities, and the vulnerability identifier is used to uniquely identify a certain type of vulnerability in a certain asset.
  • the vulnerability information can also be represented by other data, such as vulnerability type, vulnerability name, etc., as long as it can distinguish different types of vulnerabilities.
  • the analysis and defense unit 210 may further determine the network device with the device identity in the network by determining the device identity of the network device that sends the asset information 'S asset has a vulnerability with the corresponding ID number.
  • the analysis and defense unit 210 may be based on the acquired ⁇ asset model, asset version> combination and the corresponding relationship between the vulnerability ⁇ asset model, asset version—vulnerability identifier 1,..., vulnerability identifier N>, and the asset information
  • asset identification and ⁇ asset model, asset version> There is a direct correspondence between asset identification and ⁇ asset model, asset version>, and the association establishes the correspondence between ⁇ asset identification-vulnerability identification 1, ..., vulnerability identification N>.
  • the asset identifier can at least distinguish different assets of the same device, it can be based on the device identifier of the network device that sends the asset information, and the correspondence between the asset identifier of the asset information and one or more vulnerability identifiers, Determine one or more vulnerabilities corresponding to the assets of the network device.
  • the analysis and defense unit 210 may directly determine one or more vulnerabilities corresponding to the assets of the network device based on the global asset identifier, without the need to separately Obtain the device identifier of the network device.
  • the same vulnerability identification can be set for the multiple vulnerabilities in combination with the actual scenario.
  • the corresponding relationship library between the asset information and the vulnerability can be provided and maintained by a third party, and can be stored in the cloud or other network devices for the vulnerability management device 204 to call.
  • the vulnerability management device determines a vulnerability response playbook corresponding to the vulnerability information, and the vulnerability response playbook is used to execute a vulnerability defense strategy for the first network device after being parsed.
  • the vulnerability management device 204 creates a corresponding vulnerability response playbook for each vulnerability identifier.
  • the corresponding relationship between the vulnerability identifier and the vulnerability response playbook may be stored in the vulnerability response playbook unit 208.
  • the corresponding relationship between the vulnerability identifier and the vulnerability response playbook may be a one-to-one relationship or a one-to-many relationship.
  • there are multiple defense strategies for dealing with a vulnerability and the multiple defense strategies Arranged in multiple playbook scripts, or in a many-to-one relationship.
  • the treatment and defense strategies for multiple vulnerabilities are essentially the same. In this case, multiple vulnerability identifications with the same treatment and defense strategy can all point to the same playbook script , To save storage space.
  • the analysis and defense unit 210 reads the correspondence between asset information and vulnerability identifiers stored in the asset and vulnerability correspondence library 206 ⁇ asset model, asset version-vulnerability identifier 1,... , Vulnerability identification N>, and read the correspondence between the vulnerability identification stored in the vulnerability response playbook unit 208 and the playbook, analyze and determine the playbook script for emergency defense against one or more vulnerabilities in the currently analyzed asset, and determine The device identifier of the network device corresponding to the asset determines to apply the playbook script to the network device indicated by the device identifier.
  • the analysis and defense unit 210 reads the correspondence between the global asset identifier including the device identifier and the vulnerability identifier stored in the asset and vulnerability correspondence library 206 ⁇ asset identifier——vulnerability Identifier 1,..., vulnerability identifier N>, and read the correspondence between the vulnerability identifier stored in the vulnerability response playbook unit 208 and the playbook, and determine one or more vulnerabilities in the asset corresponding to the current global asset identifier for emergency defense Playbook script.
  • the playbook scripts used to defend one or more vulnerabilities of each asset are respectively determined.
  • the analysis and defense unit 210 may determine, based on the network topology information of the network device, one or more forwardings related to the network device that need to apply the playbook script to execute the vulnerability defense strategy. equipment. The analysis and defense unit 210 may determine, based on the vulnerability type corresponding to the asset, whether the sending object of the playbook script for executing the vulnerability defense strategy is the network device, the forwarding device related to the network device, or both. .
  • the corresponding relationship between the vulnerability identifier and the vulnerability response playbook script, and the specific layout content of the playbook can be provided and maintained by a third party, or can be stored in the cloud or other network devices for vulnerability Called by the management device 204.
  • the playbook script is used to parse and execute vulnerability defense of the network device assets.
  • the method 300 further includes the following content:
  • the vulnerability management device parses the vulnerability response playbook to obtain the vulnerability defense strategy, and sends the vulnerability defense strategy to the network device.
  • the vulnerability management device 204 parses the one or more playbook scripts to determine the one or more playbook scripts used to defend the network device asset And send the one or more defense strategies to the network device or a forwarding device related to the network device for execution.
  • S320 may not be executed, but S325 may be executed instead.
  • the S325 includes the following content:
  • S325 sends the playbook script to the network device or a forwarding device related to the network device.
  • the vulnerability management device 204 does not perform the analysis operation of the playbook, but sends the script of the playbook to the corresponding network device, and the network device side executes the analysis operation of the script, and Perform corresponding operations in accordance with the parsed vulnerability defense strategy.
  • the embodiment of the present application also provides a vulnerability management device 400, as shown in FIG. 4.
  • the device 400 includes a first obtaining unit 405, a second obtaining unit 410, and a vulnerability response unit 415.
  • the device 400 may be, for example, the vulnerability management device 204 shown in FIG. 2, or a device or unit integrated in the network management system 202 or other network systems and capable of implementing corresponding vulnerability defense functions.
  • the first obtaining unit 405 is configured to obtain asset information of assets of a first network device, where the asset information includes an asset identifier, an asset model, and an asset version, and the first network device is located within a controlled network.
  • the asset information may be obtained from the host device 214 and/or the network security device 212, for example.
  • the device identification corresponding to the asset information may also be obtained at the same time.
  • the second obtaining unit 410 is configured to obtain vulnerability information corresponding to the asset information based on the asset model and asset version in the asset information.
  • the corresponding relationship between the asset information and the vulnerability information can be stored in an asset and vulnerability corresponding library, and the corresponding library can be stored inside the device 400, such as the asset and vulnerability corresponding library 206 shown in FIG. 2. It can also be stored in a third-party device or cloud server.
  • the asset and vulnerability corresponding library can be updated and maintained by a third party.
  • the second acquiring unit 410 reads and calls the correspondence between the pre-saved asset information and the vulnerability information based on the asset information acquired by the first acquisition unit to acquire the vulnerability information corresponding to the asset information.
  • the first determining unit 415 is configured to determine a vulnerability response playbook corresponding to the vulnerability information, and the vulnerability response playbook is used to execute a vulnerability defense strategy for the first network device after being parsed.
  • the correspondence between the vulnerability information and the vulnerability response playbook may be stored in the system 400, such as the vulnerability response playbook unit 208 shown in FIG. 2, or may be stored in a third-party device or a cloud server.
  • the correspondence between each vulnerability information and the vulnerability response playbook may be updated and maintained by a third party.
  • the playbook is used to compile a vulnerability defense strategy script executed against the vulnerability of the network device asset.
  • the second obtaining unit 410 obtains vulnerability information corresponding to the asset information, including based on the asset model and asset version in the asset information, in the combination of asset model and asset version In the correspondence relationship with the vulnerability information, the vulnerability information corresponding to the asset model and asset version in the asset information is found.
  • the first determining unit 415 determines the vulnerability response script playbook corresponding to the vulnerability information, including: based on the correspondence between the asset identifier and the vulnerability information, and the vulnerability information and the vulnerability information. The corresponding relationship of the vulnerability response playbook is determined, the vulnerability response playbook corresponding to the asset identifier in the asset information is determined; the determined vulnerability response playbook is used as the vulnerability response playbook corresponding to the vulnerability information.
  • the second acquiring unit 410 determines the value of the asset identifier and vulnerability information based on the correspondence between the combination of the asset model and asset version and the vulnerability information, and the asset identifier, asset model, and asset version in the asset information. Correspondence.
  • the device 400 may further include a parsing unit 420 and a sending unit 425, where the parsing unit 420 is configured to parse the vulnerability response playbook to obtain the vulnerability defense strategy.
  • the sending unit 425 is configured to send the vulnerability defense strategy to the network device based on the asset identifier in the asset information, so that the network device executes the vulnerability defense strategy.
  • the asset identifier may be a global asset identifier or a local asset identifier.
  • the network device may be, for example, the host device 214 or the network security device 212 shown in FIG. 2, or a forwarding device related to the host device 214 or the network security device 212, or the like.
  • the first acquiring unit 405 and the second acquiring unit 410 may be the same acquiring unit, and are used to perform corresponding functions of the units 405 and 410.
  • the embodiment of the present application also provides a schematic structural diagram of a vulnerability management device 500.
  • the device 500 includes a processor 501, a memory 502, and a network interface 503.
  • the device 500 may be, for example, the vulnerability management device 204 shown in FIG. 2 or the vulnerability management device 400 shown in FIG. 4.
  • the network interface 503 is used to receive information from the network device and/or send required information to the network device.
  • the network interface 503 may send the information received from the network to the processor 501 and/or the memory 502, and may also send the information processed or generated by the processor 501 to the network.
  • the information is, for example, asset information of assets, or playbook scripts.
  • the network interface 503 may be a wired interface, such as a Fiber Distributed Data Interface (FDDI) or a Gigabit Ethernet (GE) interface; the network interface 503 may also be a wireless interface.
  • FDDI Fiber Distributed Data Interface
  • GE Gigabit Ethernet
  • the memory 502 is used to store computer programs and data.
  • the memory 502 includes but is not limited to random access memory (RAM), read only memory (ROM), erasable programmable read-only memory, EPROM or flash Memory), flash memory, or optical memory, etc.
  • RAM random access memory
  • ROM read only memory
  • EPROM erasable programmable read-only memory
  • EPROM erasable programmable read-only memory
  • flash memory or optical memory, etc.
  • the code of the operating system is stored in the memory 502.
  • the processor 501 may be one or more CPUs, and the CPU may be a single-core CPU or a multi-core CPU.
  • the processor 501 is configured to read the computer program and data stored in the memory 502, and execute the security vulnerability prevention method 300 described in the foregoing embodiment according to the instructions and data.
  • An embodiment of the present application also provides a computer-readable storage medium, on which a computer program is stored, and the computer program is used to execute the security vulnerability prevention method 300 described in the foregoing embodiment.
  • the size of the sequence number of each process does not mean the order of execution.
  • the execution order of each process should be determined by its function and internal logic. It should not constitute any limitation to the implementation process of the embodiments of the present application.
  • the computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium.
  • the computer instructions may be transmitted from a website, computer, server, or data center. Transmission to another website, computer, server or data center via wired (such as coaxial cable, optical fiber, twisted pair) or wireless (such as infrared, wireless, microwave, etc.).
  • the computer-readable storage medium may be any available medium that can be accessed by a computer or a data storage device such as a server or a data center integrated with one or more available media.
  • the usable medium may be a magnetic medium (for example, a floppy disk, a hard disk, and a magnetic tape), an optical medium, or a semiconductor medium (for example, a solid state disk (SSD)).

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer And Data Communications (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

一种安全漏洞防御方法和设备，所述方法包括：漏洞管理设备获取第一网络设备的资产的资产信息，所述资产信息包括资产标识、资产型号和资产版本，所述第一网络设备位于受控网络范围内；所述漏洞管理设备基于所述资产信息中的资产型号和资产版本，获取与所述资产信息对应的漏洞信息；所述漏洞管理设备确定与所述漏洞信息对应的漏洞响应剧本playbook，所述漏洞响应playbook用于被解析后执行对所述第一网络设备的漏洞防御策略。通过执行所述方法，可以快速匹配发现网络设备中存在的安全漏洞，及时生成并执行漏洞防御策略，对网络设备进行应急防护，避免网络设备在接收漏洞补丁之前遭受攻击，影响网络运行安全。

Description

一种安全漏洞的防御方法和设备
本申请要求于2019年10月22日提交中国国家知识产权局、申请号为201911007623.0、申请名称为“一种安全漏洞的防御方法和设备”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及网络安全领域，尤其涉及一种安全漏洞的防御方法和设备。
背景技术
安全漏洞，也被称为脆弱性(Vulnerability)，是指在计算机系统安全方面的缺陷，使得计算机系统或其应用数据的保密性、完整性、可用性、访问控制等面临威胁。上述缺陷包括计算机硬件、软件、以及计算机在通信协议的具体实现或安全策略方面上存在的缺陷。
为了提高网络运行的安全性，现有技术利用漏洞扫描技术对网络进行监控和扫描，及时发现网络中存在的安全漏洞。例如，漏洞扫描软件对网络中的关键网络设备进行扫描，将扫描过程中发现的网络设备存在的安全漏洞和安全配置等级等信息上报网络管理系统。网络管理系统根据接收到的扫描结果，向相应的网络设备下发安全补丁，以用于修复所述网络设备存在的漏洞。网络管理系统本身保存有安全补丁，或者网络管理系统基于漏洞型号通过网络向第三方安全补丁提供方获取安全补丁。例如，对于在应用软件中发现的安全漏洞，网络管理系统基于所述应用软件的版本从应用软件开发厂商的技术支持网站下载相应补丁等。但是，对于某些新出现的漏洞，应用软件开发厂商可能无法及时提供补丁，并且补丁的开发时间通常较长，这导致对于当前网络中漏洞的安全处置和防御会出现一个空窗期。在空窗期内网络极其容易遭受黑客攻击，从而影响了网络的安全运行。即使应用软件开发厂商加快补丁开发速度，但随着被发现后立即恶意利用的零日漏洞的不断增多，网络安全性难以保障。
发明内容
本申请实施例提供了一种安全漏洞的防御方法和设备，用于提升网络进行应急处置和防御的及时性，降低网络遭受攻击的可能性。
第一方面，提供了一种安全漏洞的防御方法。所述方法包括漏洞管理设备获取第一网络设备的资产的资产信息，所述资产信息包括资产标识、资产型号和资产版本，所述第一网络设备位于受控网络范围内；所述漏洞管理设备基于所述资产信息中的资产型号和资产版本，获取与所述资产信息对应的漏洞信息；所述漏洞管理设备确定与所述漏洞信息对应的漏洞响应剧本playbook，所述漏洞响应playbook用于被解析后执行对所述第一网络设备的漏洞防御策略。
本申请实施例利用漏洞响应playbook相对于安全补丁，开发快捷灵活的优势，提供 了一种基于漏洞响应playbook的安全漏洞防御方法。具体地，漏洞管理设备根据受控网络中网络设备上资产的安全漏洞获取对应的漏洞响应playbook，并进一步根据获取的漏洞响应playbook以便于对网络设备执行漏洞防御策略。该方法用于在安全补丁可用之前，例如软件开发商或第三方安全补丁提供方未针对网络的安全漏洞发布安全补丁或有效安全策略前，通过自动化地响应对网络进行应急处置和防御，避免网络遭受攻击，提高了网络的健壮性和安全性。
在一种可能的设计中，所述获取与所述资产信息对应的漏洞信息，包括所述漏洞管理设备基于所述资产信息中所述资产型号和资产版本，在资产型号和资产版本的组合与漏洞信息的对应关系中，查找到与所述资产信息中所述资产型号和资产版本对应的漏洞信息；所述漏洞管理设备基于所述资产型号和资产版本的组合与漏洞信息的对应关系，以及所述资产信息中所述资产标识、资产型号和资产版本，确定所述资产标识和漏洞信息的对应关系。
通过基于资产型号和资产版本的匹配，确定资产标识和漏洞信息的对应关系，以便于后续确定需执行漏洞防御策略的网络设备，保证漏洞防御的准确性。
在一种可能的设计中，所述漏洞管理设备确定与所述漏洞信息对应的漏洞响应剧本playbook，包括：所述漏洞管理设备基于所述资产标识和漏洞信息的对应关系，以及所述漏洞信息和所述漏洞响应playbook的对应关系，确定所述资产信息中的所述资产标识对应的所述漏洞响应playbook；将确定出的所述漏洞响应playbook作为所述与所述漏洞信息对应的漏洞响应playbook。
在一种可能的设计中，所述漏洞管理设备解析所述漏洞响应playbook得到所述漏洞防御策略；所述漏洞管理设备基于与所述资产信息中的所述资产标识，向所述第一网络设备发送所述漏洞防御策略，以使得所述第一网络设备执行所述漏洞防御策略。
漏洞管理设备可以直接向第一网络设备发送漏洞响应playbook，由第一网络设备对漏洞响应playbook进行解析后得到漏洞防御策略并执行漏洞防御策略。这种方式漏洞管理设备省略了解析漏洞响应playbook的步骤，降低了漏洞管理设备的处理负荷，但第一网络设备需要支持解析漏洞响应playbook的功能，对第一网络设备的性能要求较高。漏洞管理设备也可以解析所述漏洞响应playbook得到所述漏洞防御策略后，向第一网络设备发送漏洞防御策略。这种方式由漏洞管理设备执行解析漏洞响应playbook的步骤，会增加漏洞管理设备的处理负荷，但第一网络设备无需支持解析漏洞响应playbook的功能，对第一网络设备的性能要求较低。在实际应用中，可以根据网络设备和漏洞管理设备的硬件条件，灵活选择上述两种方式之一。
在一种可能的设计中，所述资产信息中的所述资产标识为全局资产标识，所述全局资产标识包括所述第一网络设备的设备标识，所述全局资产标识在所述受控网络范围内是唯一的，所述向所述第一网络设备发送所述漏洞防御策略之前，所述方法还包括从所述全局资产标识中获取包括的所述第一网络设备的设备标识；所述向所述第一网络设备发送所述漏洞防御策略，具体为根据所述第一网络设备的设备标识，向所述第一网络设备发送所述漏洞防御策略。
通过在全局资产标识中携带设备标识信息，可以提高网络传输效率、节约网络资源。
在一种可能的设计中，所述漏洞管理设备解析所述漏洞响应playbook得到所述漏洞防御策略；向与所述第一网络设备相关的转发设备发送所述漏洞防御策略，以使得与所述 第一网络设备相关的转发设备执行所述漏洞防御策略。
在一种可能的设计中，所述向与所述第一网络设备相关的转发设备发送所述漏洞防御策略之前，所述方法还包括所述漏洞管理设备获取所述第一网络设备的设备标识，以及所述受控网络的网络拓扑信息；所述漏洞管理设备基于所述网络拓扑信息，确定与所述第一网络设备相关的所述转发设备。
对于短期内难以进行补丁修补的网络设备的漏洞，可以通过在与所述网络设备相关的转发设备上执行漏洞防御策略，为所述网络设备隔离存在风险的数据和设备，避免所述网络设备被攻击。
在一种可能的设计中，所述漏洞管理设备获取所述第一网络设备的设备标识，具体为：所述漏洞管理设备基于所述资产信息中的所述资产标识，获取所述第一网络设备的所述设备标识，其中，所述资产标识为全局资产标识，所述全局资产标识包括所述第一网络设备的所述设备标识，并且所述全局资产标识在所述受控网络范围内是唯一的，所述漏洞管理设备基于所述全局资产标识获取所述第一网络设备的所述设备标识，或者，所述资产标识为局部资产标识，并且所述局部资产标识在所述第一网络设备内是唯一的，所述漏洞管理设备基于所述局部资产标识和所述设备标识的对应关系，获取所述第一网络设备的所述设备标识。
在一种可能的设计中，所述漏洞防御策略包括基于访问控制列表ACL的访问控制策略、基于特征串的正则过滤策略、和/或入侵防护系统IPS防护签名策略。
第二方面，提供了一种漏洞管理设备。所述设备包括第一获取单元，用于获取第一网络设备的资产的资产信息，所述资产信息包括资产标识、资产型号和资产版本，所述第一网络设备位于受控网络范围内；第二获取单元，用于基于所述资产信息中的资产型号和资产版本，获取与所述资产信息对应的漏洞信息；第一确定单元，用于确定与所述漏洞信息对应的漏洞响应剧本playbook，所述漏洞响应playbook用于被解析后执行对所述第一网络设备的漏洞防御策略。
在一种可能的设计中，所述第二获取单元获取与所述资产信息对应的漏洞信息，包括基于所述资产信息中所述资产型号和资产版本，在资产型号和资产版本的组合与漏洞信息的对应关系中，查找到与所述资产信息中所述资产型号和资产版本对应的漏洞信息；基于所述资产型号和资产版本的组合与漏洞信息的对应关系，以及所述资产信息中所述资产标识、资产型号和资产版本，确定所述资产标识和漏洞信息的对应关系。
在一种可能的设计中，所述第一确定单元确定与所述漏洞信息对应的漏洞响应剧本playbook，包括基于所述资产标识和漏洞信息的对应关系，以及所述漏洞信息和所述漏洞响应playbook的对应关系，确定所述资产信息中的所述资产标识对应的所述漏洞响应playbook；将确定出的所述漏洞响应playbook作为所述与所述漏洞信息对应的漏洞响应playbook。
在一种可能的设计中，所述设备还包括解析单元，用于解析所述漏洞响应playbook得到所述漏洞防御策略；发送单元，用于基于与所述资产信息中的所述资产标识，向所述第一网络设备发送所述漏洞防御策略，以使得所述第一网络设备执行所述漏洞防御策略。
在一种可能的设计中，所述资产信息中的所述资产标识为全局资产标识，所述全局资产标识包括所述第一网络设备的设备标识，所述全局资产标识在所述受控网络范围内是唯一的，所述发送单元向所述第一网络设备发送所述漏洞防御策略之前，所述设备还包括所 述第一获取单元从所述全局资产标识中获取包括的所述第一网络设备的设备标识；所述发送单元向所述第一网络设备发送所述漏洞防御策略，具体为：根据所述第一网络设备的设备标识，向所述第一网络设备发送所述漏洞防御策略。
通过在全局资产标识中携带设备标识信息，可以提高网络传输效率、节约网络资源。
在一种可能的设计中，所述设备还包括解析单元，用于解析所述漏洞响应playbook得到所述漏洞防御策略；发送单元，用于向与所述第一网络设备相关的转发设备发送所述漏洞防御策略，以使得与所述第一网络设备相关的转发设备执行所述漏洞防御策略。
在一种可能的设计中，所述发送单元向与所述第一网络设备相关的转发设备发送所述漏洞防御策略之前，所述设备还包括所述第一获取单元获取所述第一网络设备的设备标识，以及所述受控网络的网络拓扑信息；第二确定单元，用于基于所述网络拓扑信息，确定与所述第一网络设备相关的所述转发设备。
对于短期内难以进行补丁修补的网络设备的漏洞，可以通过在与所述网络设备相关的转发设备上执行漏洞防御策略，为所述网络设备隔离存在风险的数据和设备，避免所述网络设备被攻击。
在一种可能的设计中，所述第一获取单元获取所述第一网络设备的设备标识，具体为：基于所述资产信息中的所述资产标识，获取所述第一网络设备的所述设备标识，其中，所述资产标识为全局资产标识，所述全局资产标识包括所述第一网络设备的所述设备标识，并且所述全局资产标识在所述受控网络范围内是唯一的，所述第一获取单元基于所述全局资产标识获取所述第一网络设备的所述设备标识，或者，所述资产标识为局部资产标识，并且所述局部资产标识在所述第一网络设备内是唯一的，所述第一获取单元基于所述局部资产标识和所述设备标识的对应关系，获取所述第一网络设备的所述设备标识。
在一种可能的设计中，所述漏洞防御策略包括基于访问控制列表ACL的访问控制策略、基于特征串的正则过滤策略、和/或入侵防护系统IPS防护签名策略。
第三方面，提供一种漏洞管理设备，包括处理器和存储器，所述存储器用于存储计算机程序，所述处理器用于调用存储器中存储的计算机程序，执行第一方面中任意可能的设计中描述的相应方法。
第四方面，提供一种计算机可读存储介质，所述存储介质上存储有计算机程序，用于执行第一方面中任意可能的设计中描述的相应方法。
第五方面，提供了一种包含指令的计算机程序产品，当其在计算机上运行时，使得计算机执行上述第一方面或第一方面的任意一种可能的实现方式中所述的方法。
第六方面，本申请实施例提供了一种芯片，包括存储器和处理器，存储器用于存储计算机指令，处理器用于从存储器中调用并运行该计算机指令，以执行上述第一方面及其第一方面任意可能的实现方式中的方法。
附图说明
图1是在一种技术方案中提供的一种漏洞管理系统的结构示意图；
图2为本申请实施例提供的一种用于实现网络漏洞防御的网络系统结构示意图；
图3为本申请实施例提供的一种安全漏洞防御方法的流程示意图；
图4为本申请实施例提供的一种漏洞管理设备的结构示意图；
图5为本申请实施例提供的另一种漏洞管理设备的结构示意图。
具体实施方式
为使本申请的目的、技术方案和优点更加清楚，下面将结合附图对本申请实施例做出进一步地详细描述。
本申请实施例描述的应用场景是为了更加清楚的说明本申请实施例的技术方案，并不构成对于本申请实施例提供的技术方案的限定，本领域普通技术人员知晓，随着网络设备架构的演变和新应用场景的出现，本申请实施例提供的技术方案对于类似的技术问题，同样适用。
图1是在一种相关技术方案中提供的一种漏洞管理系统100的结构示意图，用于实现对主机的漏洞扫描和补丁修复。漏洞管理系统100包括主机设备106和漏洞管理服务器101。漏洞管理服务器101包括漏洞扫描器104和补丁管理模块102。可选地，漏洞扫描器104和补丁管理模块102由软件实现。例如漏洞扫描器是Tenable公司推出的漏洞扫描器NESSUS、或者开源扫描工具Nmap、或者Unix操作系统平台的网络工具netcat等等。例如补丁管理模块是SolarWinds公司推出的SolarWinds，或者其他网络管理方自行开发的软件模块等等。可选地，上述漏洞扫描器104和补丁管理模块102可以集成于IBM公司推出的NetView网络管理系统，或者HP公司推出的网络管理系统OpenView中。
主机设备106例如可以是智能终端、平板电脑、台式机等用户设备，也可以是企业级的网络管理设备等。
漏洞扫描器104可以通过网络监控和扫描主机设备106，发现主机设备106中存在的各种安全漏洞，如系统漏洞、安全软件漏洞、或应用软件漏洞等。漏洞扫描器104向补丁管理模块102发送所发现的主机设备106的漏洞信息。补丁管理模块102基于所述漏洞信息，确定是否存在用于修补相应漏洞的补丁信息，如果有相应的补丁信息，则向主机设备106下发。主机设备106包括修补单元108，修补单元108通过主机设备106接收的补丁信息为主机设备打补丁，修补系统漏洞。漏洞管理系统100中各设备或设备各单元之间的交互可参见图1中的步骤s105-s120。
漏洞管理系统100能够对主机设备106存在的安全漏洞进行远程监测和修补，从而在一定程度上减少了网络主机被攻击的风险。然而，一方面对于某些新出现的漏洞，由于很难及时提供补丁，采用上述方式往往无法有效地抵挡黑客攻击，由此造成网络安全问题。另一方面，在当前的网络构成中，除了对终端主机造成的不利影响，网络漏洞还会在很大范围内影响网络中的其他关键网络设备，如服务器及其软硬件、路由器、交换机和安全防火墙等，此时仅对主机系统进行安全扫描仍无法有效防范全网漏洞。
图2是本申请实施例提供的一种用于实现安全漏洞防御的网络系统的结构示意图。所述网络系统包括多台主机设备214、多台网络安全设备212、网管系统202和漏洞管理设备204。网络安全设备212例如可以是网络中具有一定安全防御能力的设备，如安全网关、防火墙、路由器、或交换机等。主机设备214和/或网络安全设备212向网管系统202发送所述设备上相关资产的资产信息，如S205所示。在一种可能的实现方式中，也可以是网络中需要进行漏洞分析和防御的其他类型的设备，向网管系统202发送所述设备上相关资产的资产信息，这可以结合实际应用场景具体确定。
可选地，所述资产包括物理资产和逻辑资产中任一个或二者。可选地，物理资产是网络中的设备或设备上的硬件或组件，逻辑资产是运行在网络中设备上的软件或由通信网络中设备所存储的信息。作为示例，物理资产包括多核CPU，或者固态驱动器(Solid State Disk，SSD)阵列，逻辑资产包括网络中防御设备上的操作系统、软件应用等。所述资产与其型号和版本相关。例如，对于同一台主机设备214，其操作系统和运行在系统上的软件应用A属于不同的资产，而运行在同一主机系统上的软件应用A和软件应用B也属于不同的资产；再例如，对于包括两个虚拟机的某主机设备214，虽然在两个所述虚拟机上分别运行相同的软件应用A，但是由于运行在不同虚拟机上的软件应用A的版本不同，则仍将上述两个不同版本的软件应用A认作不同的资产。两个主机设备214上分别运行的两个不同型号的软件应用属于不同资产，而其上分别运行的两个型号相同但版本不同的软件应用也属于不同资产。但是，如果仅按照资产型号和资产版本确定资产，则两个主机设备214上分别运行的两个相同型号的相同版本的资产是无法区分的；或者，对于包括两个虚拟机的某主机设备214，所述两个虚拟机上分别运行的同一型号、同一版本的两个资产也无法区分。为此，所述资产可以使用资产标识，以对同一型号、同一版本的多个资产进行区分。所述资产标识可以是全局资产标识，所述全局资产标识在受控网络范围内是唯一的，能够全网唯一地标识某个特定网络设备上的某个特定资产。在一种可能的实现方式中，所述全局资产标识中可以包括资产所述的网络设备的设备标识。所述资产标识也可以是局部资产标识，所述局部资产标识在某个特定网络设备，如主机设备214或网络安全设备212等的内部是唯一的，以至少保证在同一网络设备内可以唯一地标识某个特定资产。
所述资产可以用资产信息表示，所述资产信息至少包括资产标识、资产型号和资产版本，例如所述资产信息表示为<资产标识、资产型号、资产版本>。每个网络设备，如主机设备214或网络安全设备212，可以确定一个或多个需要进行安全漏洞防御的资产。所述网络设备可以向网管系统202发送需要进行安全漏洞防御的资产的资产信息。所述发送例如可以按照一定的时间周期定期执行，或者在例如满足某种条件被触发时不定期执行，如一定时间段内发现的漏洞个数满足阈值，或者命中关键漏洞列表，或者发现的漏洞总数超过预设值等。在实际应用场景中，所述网络设备可以逐个发送每个资产的资产信息，或者也可以一次发送多个资产的资产信息，以提高发送效率。当发送多个所述资产的所述资产信息时，每次发送的具体范围可以根据实际需要确定，例如，可以包括全部有必要进行漏洞检测的资产的资产信息，或者按照网管系统202预设的规则，发送与所述预设规则相符的指定资产的资产信息，或者按照资产优先级发送部分资产的资产信息等。为便于描述，这里定义每次发送的所述一个或多个资产信息构成一个资产信息组。
为了更清晰地说明，以下给出一种主机设备214单次发送的一个所述资产信息组的表示形式作为示例。在一种可能的实现方式中，主机设备214可以向所述网管系统202发送所述资产信息组，
<主机设备A-ZC1、Office 2017、V1.0>，
<主机设备A-ZC2、Office 2017、V1.1>，
<主机设备A-ZC3、Google Ghrome、V3.1.2>，
<主机设备A-ZC4、Access Client、V4.5.1>。
以上资产信息组的表示形式仅作为示例，实际应用中资产标识、资产型号和资产版本的具体实现形式和数量等可根据需要确定。例如，可以采用全网唯一的8位二进制码表示 资产标识，如将“主机设备A-ZC1”替换表示为10001001，“主机设备A-ZC2”替换表示为10001010等。例如，基于资产型号和资产版本的组合建立标识符对应表，如“Office 2017、V1.0”对应标识符1001，“Office 2017、V1.1”对应标识符1010，则上述资产信息组中的<主机系统A-ZC1、Office 2017、V1.0>可表示为<10001001、1001>，<主机系统A-ZC2、Office 2017、V1.1>可表示为<10001010、1010>，以此可以节约发送资产信息组数据所需的带宽资源。需要说明的是，无论采用哪种具体的资产信息组的表达形式，需保证接收相应资产信息的网管系统202或其他可能的系统理解相应的解析规则。
如图2中的S205所示，网管系统202接收到主机设备214发送的所述资产信息组。对于所述资产信息组中的一个或多个资产信息包括局部资产标识，或者包括不含设备标识的全局资产标识的情形，网管系统202确定分别与所述一个或多个资产信息对应的主机设备214的设备标识。对于一个或多个资产信息包括全局资产标识，并且所述全局资产标识包括主机设备214的设备标识的情形，网管系统202可以从所述全局资产标识中获取设备标识，无需根据其他信息为所述一个或多个资产信息确定设备标识。在一种可能的实现方式中，网管系统202还确定主机设备214的网络拓扑信息，所述网络拓扑信息为与主机设备214相关的其他网络设备的地址信息和/或路径信息等，所述其他网络设备例如可以是与主机设备214相关的转发设备，如网管防火墙、路由器和交换机等网络安全设备212，以用于后续直接向与主机设备相关的网络安全设备212发送漏洞应急防御策略，至少保证主机设备212在安装漏洞补丁前的使用安全。所述网络拓扑信息可以通过网管系统202自动获取，也可以由网络管理员在接收到所述资产信息组后手动配置。如S210所示，网管系统202向漏洞管理设备204发送主机设备214的所述资产信息组以及对应的所述网络拓扑信息和/或设备标识。可选地，网管系统202通过拓扑发现机制生成网络拓扑信息。
作为漏洞管理对象的网络设备包括主机设备214和网络安全设备212。以上实现方式仅用主机设备214作为示例，但可以理解的，网络安全设备212也可以采用类似地方式向漏洞管理设备204发送网络安全设备212的资产信息组以及对应的所述网络拓扑信息和/或设备标识。在一些可能的实现方式中，发送所述资产信息组的主机设备214或网络安全设备212的设备标识可以由所述主机设备214或网络安全设备212自身携带并发送给网管系统202；或者，由网管系统202根据发送所述资产信息组的主机设备214或网络安全设备212的相关信息，在本地确定相应的设备标识。在一种可能的实现方式中，网络中的其他设备向网管系统202发送所述网络设备的资产的资产信息，例如，对于主机设备214，与主机设备214相关的转发设备，如用于防护主机设备214的网关防火墙，或者用于为主机设备214转发数据的路由器、交换机等，有时也可以通过读取和分析需向主机设备214发送的数据报文等，发现主机设备214上的资产信息，在上述情形下，由网关防火墙或者路由器、交换机为例的其他设备向网管系统202发送主机设备214的资产信息。在其他设备在发送资产信息时，可以一并发送主机设备214的设备标识，以标识所述资产信息属于主机设备214上的资产。在一种可能的实现方式中，为节约带宽和提高传输效率，网管系统202还可以将整个网络的网络拓扑信息发送给漏洞管理设备204，使得漏洞管理设备204能够根据与所述资产信息组关联的所述设备标识，以及所述整个网络的网络拓扑信息，确定需要执行漏洞防御策略的与主机设备214对应的转发设备212。对于网管系统202将整个网络的网络拓扑信息发送给漏洞管理设备204的情形，网管系统202可以定期或不定期地为漏洞管理设备204更新网络拓扑信息，以保证基于网络拓扑信息执行漏洞防御策略的 有效性和可靠性。所述更新可以是对于整个网络的拓扑信息的全部或部分更新。
漏洞管理设备204包括资产和漏洞对应库206、漏洞响应剧本(英文：playbook)单元208、分析和防御单元210。资产和漏洞对应库206用于保存资产和漏洞的对应关系，所述对应关系可以是一对一的关系，也可以是一对多的关系，即一个资产可以包括多个漏洞。资产与漏洞的对应关系可以通过所述资产的资产信息中的<资产型号、资产版本>进行唯一索引，即具有相同资产版本和资产型号的资产，其与漏洞的对应关系也是相同的。以下给出一种可能的资产和漏洞对应关系的表示形式。
<Office 2017、V1.0——漏洞1，漏洞2，漏洞3>，
<Office 2017、V1.1——漏洞4，漏洞5>，
<Google Ghrome、V3.1.2——漏洞6，漏洞7>，
<Access Client、V4.5.1——漏洞8>。
上述表示形式中，相同资产的不同漏洞具有不同的ID编号，如资产<Office 2017、V1.0>中的漏洞1、漏洞2和漏洞3的ID编号不同；考虑有时即使漏洞型号相同，在不同资产中针对相同漏洞型号的处置方式也未必相同，因此在一种可能的实现方式中，不同资产的相同漏洞也具有不同的漏洞标识，如即使漏洞1和漏洞4具有相同的型号，但由于其分别属于不同的资产，则也具有不同的漏洞标识，以此可以方便资产漏洞的管理。在另一种可能的实现方式中，在分别对应于不同资产的多个漏洞实际相同的情形下，如果能够确认用于防御所述多个漏洞的漏洞防御策略也相同时，可以为所述多个漏洞赋予相同的漏洞标识，以节约存储资源。
在其他可能的实现方式中，也可以根据需要定义资产和漏洞对应关系的其他表示形式。例如，与所述资产信息组的表示形式对应地，也可以将<Office 2017、V1.0——漏洞1，漏洞2，漏洞3>表示为<1001——漏洞1，漏洞2，漏洞3>，或者将<Office 2017、V1.0——漏洞1，漏洞2，漏洞3>拆分为<Office 2017、V1.0——漏洞1>、<Office 2017、V1.0——漏洞2>和<Office 2017、V1.0——漏洞3>，或者可以将漏洞也按照某种预先定义的规则进行编号等。具体表达方式可以结合实际需求和场景自行定义。
在一种可能的实现方式中，<资产型号、资产版本>和漏洞的对应关系可以由软件产品生产商、硬件产品制造商或者安全漏洞管理商等第三方发布，然后由漏洞管理设备204接收或下载，并保存在本地的资产和漏洞对应库206中。在另一种可能的实现方式中，由所述第三方发布针对资产的漏洞提示信息，漏洞管理设备204接收到所述漏洞提示信息后，建立相应资产与漏洞之间的对应关系，并保存在本地的漏洞对应库206。在其他可能的实现方式中，资产和漏洞对应库206可以不存储在漏洞管理设备204中，而是设置在其他设备或云端，供漏洞管理设备204直接调用或临时下载，由此提高漏洞管理设备204的使用灵活性和实时性。
漏洞响应playbook单元208用于保存针对漏洞的漏洞响应Playbook。playbook是一种用于管理网络中网元的配置、部署和编排的语言，可以利用该语言为一个或多个网元编排一系列具有逻辑性的操作，供所述一个或多个网元解析并执行。编排管理员能够编排一套用于指导一个或多个网元设备执行一系列特定操作的playbook，例如按照playbook执行与安全防御相关的一系列动作等。playbook可以使得编排管理员聚焦于编排操作的逻辑本身，而隐藏了连接各个系统的编程接口及其指令实现。通过能够支撑playbook脚本语言解析的解析引擎实现具体可编程指令和相应系统的对接及执行。与漏洞对应的应急响应 playbook，即针对漏洞所编排制定的一套应急响应动作的playbook脚本，用于在必要阶段先执行相应的应急防御策略，以避免在空窗期内出现针对所述漏洞的恶意攻击。所述必要阶段例如可以是发现漏洞但未发布补丁之前，或者漏洞补丁不足以应对新的攻击方式，需要进行补丁升级，或者在非常时期或者非常情形下需要提高漏洞防御等级等。以上列举的情形仅作为示例，具体在何种场景下启动playbook漏洞防御策略可根据需要设定。
具体的应急防御策略可以结合实际应用场景选择和设计，例如执行访问控制列表(英文：Access Control List，ACL)访问控制策略、基于特征串的正则过滤策略、和/或入侵防护系统(英文：Intrusion Prevention System，IPS)防护签名策略等。采用ACL访问控制策略可以向路由器接口等发放指令列表，以指示路由器对数据包执行接受或拒绝操作。在应急防护状态下，例如可以利用ACL指令列表限制路由器仅接受可信任的数据包，以此保证路由器不受恶意数据包的威胁。采用基于特征串的正则过滤策略，则可以通过与设定的控制字符串的匹配，保障例如用户终端、网关防火墙等的安全性。例如，可以预先设置用于表征非法的域名系统(英文：Domain Name System，DNS)的特征字符串，以此过滤掉潜在非法用户对系统的访问和攻击等。IPS防护签名策略主要基于已搜集的历史漏洞信息和攻击特征等，建立和维护特征行为分类过滤器，例如网关防火墙等通过对流经的网络流量进行分类和检查，利用分类过滤器检测并阻断入侵行为，诸如应用漏洞攻击、木马、间谍软件、可疑网络操作(远程控制、广告插件等)等。
漏洞响应playbook单元208保存资产的漏洞与playbook之间的对应关系，在一种可能的实现方式中，所述漏洞与playbook的对应关系可以是一对一的关系，漏洞与playbook的对应关系可以通过<资产型号、资产版本、漏洞标识>进行唯一索引，即对于同一资产的同一漏洞标识，其与playbook的对应关系也是相同的。以下给出一种可能的漏洞和playbook对应关系的表示形式。
<Office 2017、V1.0、漏洞1——playbook 1>，
<Office 2017、V1.0、漏洞2——playbook 2>，
<Office 2017、V1.0、漏洞3——playbook 3>，
<Office 2017、V1.1、漏洞4——playbook 4>，
……，
<Access Client、V4.5.1、漏洞8——playbook 8>。
在另一种可能的实现方式中，当确认针对多个不同的漏洞标识所编排的playbook脚本实质相同时，可以考虑将所述多个不同的漏洞标识与同一playbook相对应，即多个不同资产的多个漏洞与playbook的对应关系有时可以是多对一的关系，以节约存储资源。
在一种可能的实现方式中，与漏洞对应的playbook可以由所述第三方发布，因而漏洞响应playbook单元208也可以不在漏洞管理设备204中，而是设置在其他设备或云端，供漏洞管理设备204直接调用或临时下载。
如前所描述的，资产的资产信息可以表示为<资产标识、资产型号、资产版本>，如S215所示，分析和防御单元210可以基于所述资产信息中的<资产型号、资产版本>，以及资产和漏洞对应关系<资产型号、资产版本、漏洞标识>，分析并建立资产标识和漏洞标识之间的对应关系，例如<资产标识、资产型号、资产版本、漏洞标识>，或者仅匹配并建立<资产标识、漏洞标识>的对应关系。当所述资产标识为包括设备标识的全局资产标识时，分析和防御单元210可以直接基于所述资产标识确定资产所述的网络设备，并建立所述网 络设备上的特定资产和漏洞标识之间的对应关系；当所述资产标识为局部资产标识或不包括设备标识的全局资产标识时，分析和防御单元210还需要确定与包括所述资产标识的所述资产信息对应的设备标识，由此确定一个网络设备上的特定资产和漏洞标识之间的对应关系。
分析和防御单元210还可以获取发送所述资产的资产信息的主机设备214或网络安全设备212的网络拓扑信息，以确定与主机设备214或网络安全设备212相关的转发设备。分析和防御单元210通过所述漏洞标识可以获得用于应急处置和防御漏洞的playbook脚本。如S220所示，分析和防御单元210对确定的所述playbook脚本进行解析，以获得用于处置资产漏洞的漏洞防御策略。通过与所述漏洞标识相关联的资产标识，以及在前述某些情形下所必要的设备标识，可以获知需向哪个网络设备发送解析后的所述漏洞防御策略，以及用于防御所述网络设备的哪个资产中的漏洞。在一些情形下，分析和防御单元210还可以基于与所述网络设备对应的网络拓扑信息，向与所述网络设备相关的一个或多个转发设备发送解析playbook脚本后获得的用于防御漏洞的漏洞防御策略，所述转发设备例如可以是与所述网络设备相关的网络安全设备212。所述主机设备214或网络安全设备212基于接收的所述漏洞防御策略执行相应的防御操作。
在一种可能的实现方式中，分析和防御单元210也可以不解析所述playbook脚本，而是直接发送到相应的所述主机设备214或网络安全设备212，由所述主机设备214或网络安全设备212对所述playbook脚本进行解析，以执行相应的漏洞防御策略，保障网络系统的运行安全。
在其他可能的实现方式中，漏洞管理设备204先向网管系统202发送用于修复一个或多个安全漏洞的playbook脚本，然后由网管系统202向主机设备214或网络安全设备212发送所述playbook脚本，或者由网管系统202向主机设备214或网络安全设备212发送解析所述playbook脚本后生成的漏洞防御策略；或者，漏洞管理设备204并不独立于网管系统202存在，而是作为网管系统202的组成部分集成其中，用于实现相应的漏洞分析和防御功能；或者，漏洞管理设备204也可以集成在网络的其他设备或系统中。
图3为本申请实施例提供的一种安全漏洞防御方法300的流程示意图，所述方法300例如可以由图2中的漏洞管理设备204执行，或者由网管系统202或其他网络设备中集成的能够实现相应漏洞防御功能的设备或单元执行等。所述方法300包括以下内容。
S305，漏洞管理设备获取第一网络设备的资产的资产信息，所述资产信息包括资产标识、资产型号和资产版本，所述第一网络设备位于受控网络范围内。
在一种可能的实现方式中，漏洞管理设备204获取网络设备中相关资产的资产信息。所述网络设备的资产的资产信息可以由所述网络设备自身获取，也可以由网络中的其他设备获取。对于从所述其他设备获取的情形，例如，当所述网络设备为主机设备214时，与主机设备214相关的其他设备，如转发设备，可以通过读取和分析需向主机设备214发送的数据报文等，发现主机设备214上的资产对应的资产信息。所述网络设备例如可以是图2示出的网络安全设备212或主机设备214。以一台主机设备214为例，其上可能包括一个需要进行漏洞防御的关键资产，所述资产可以用对应的资产信息进行描述，所述资产信息可以包括资产标识、资产型号和资产版本。可选地，所述资产信息也可包括其他类型的信息，只要能够用足够维度的信息区分不同的资产即可，具体包括哪些信息可根据实际应用场景确定。一个主机设备214上也可以包括多个资产，此时漏洞管理设备204需要获取 分别与所述多个资产对应的多组资产信息。
所述资产标识用于标识不同的资产，以向相应网络设备针对性地快速下发资产漏洞防御策略。例如，所述资产标识为全局资产标识，所述全局资产标识在所述受控网络范围内是唯一。在一种可能的实现方式中，所述全局资产标识包括所述第一网络设备的设备标识。再例如，所述资产标识为局部资产标识，所述局部资产标识在所述第一网络设备内是唯一的。当一个网络设备中具有需要进行漏洞防御的多个资产时，漏洞管理设备204能够获取分别对应于多个资产的多个资产信息。所述网络设备的设备标识例如可以是设备ID、设备的网际协议(英文：Internet Protocol，IP)地址或媒体存取控制(英文：Media Access Control，MAC)地址等。所述设备标识可以由网络安全设备212或主机设备214发送，也可以由网管系统202根据接收所述资产信息时的发送方信息确定并添加。
S310，所述漏洞管理设备基于所述资产信息中的资产型号和资产版本，获取与所述资产信息对应的漏洞信息。
漏洞管理设备204的分析和防御单元210可以基于所述网络设备的资产与漏洞之间的对应关系，确定所述网络设备中所述资产的一个或多个需要防御的漏洞。具体地，资产和漏洞对应库206中可以存储<资产型号，资产版本>的组合与漏洞之间的对应关系，所述对应关系可以是一对一的关系，也可以是一对多的关系，即一个<资产型号，资产版本>组合对应于多个漏洞。所述<资产型号，资产版本>组合与漏洞之间的对应关系的表达形式可以是<资产型号、资产版本——漏洞标识1，……，漏洞标识N>，N表示所述资产信息对应的漏洞个数，所述漏洞标识用于唯一的标识某个资产中的某种漏洞。在其他可能的实现方式中，所述漏洞信息也可以用其他数据表示，如漏洞类型、漏洞名称等，只要能够区别性的表示不同类型的漏洞即可。
对于所述网络设备发送的信息为所述资产信息的情形，分析和防御单元210可以进一步通过确定发送所述资产信息的所述网络设备的设备标识，确定网络中具有所述设备标识的网络设备的资产具有相应ID编号的漏洞。
分析和防御单元210可以基于获取的<资产型号，资产版本>组合与漏洞之间的对应关系<资产型号、资产版本——漏洞标识1，……，漏洞标识N>，以及所述资产信息中资产标识与<资产型号，资产版本>直接的对应关系，关联建立<资产标识——漏洞标识1，……，漏洞标识N>之间的对应关系。由于资产标识至少可以区分地标识同一设备的不同资产，因此可以基于发送所述资产信息的网络设备的设备标识，以及所述资产信息的资产标识与一个或多个漏洞标识之间的对应关系，确定与所述网络设备的资产对应的一个或多个漏洞。或者，对于所述资产标识为包括设备标识的全局资产标识时，分析和防御单元210可以直接基于所述全局资产标识确定与所述网络设备的资产对应的一个或多个漏洞，而无需再单独获取所述网络设备的设备标识。
对于不同资产中多个漏洞的种类实际相同的情形，可以结合实际场景为所述多个漏洞设置相同的漏洞标识，例如当确定针对所述多个漏洞的安全防御策略完全相同时，以此节约存储空间，提高存储效率；也可以为所述多个漏洞设置不同的漏洞标识，例如当所述多个漏洞的种类虽然相同，但在不同资产中采取的相应防御策略并不相同时；或者即使防御策略相同，但为了实现相应的防御策略而执行的具体操作步骤不同时；再或者即使防御策略和相应的执行步骤等均实质相同，但处于便于管理和执行等目的，仍可以为分别属于不同资产的多个同种漏洞设置不同的漏洞标识。
需要说明的是，当所述网络设备上需进行漏洞防御的资产具有多个时，与所述网络设备关联的资产信息与漏洞信息之间的对应关系具有多组。
在一种可能的实现方式中，所述资产信息与漏洞之间的对应关系库可由第三方提供和维护，可以存储在云端或其他网络设备上以供漏洞管理设备204调用。
S315所述漏洞管理设备确定与所述漏洞信息对应的漏洞响应剧本playbook，所述漏洞响应playbook用于被解析后执行对所述第一网络设备的漏洞防御策略。
可选地，漏洞管理设备204为每个漏洞标识分别建立对应的漏洞响应playbook。所述漏洞标识与漏洞响应playbook之间的对应关系可以保存在漏洞响应playbook单元208。所述漏洞标识与漏洞响应playbook之间的对应关系可以是一对一的关系，也可以是一对多的关系，例如用于处置一个漏洞的防御策略有多个，而所述多个防御策略编排在多个playbook脚本中，或者也可以是多对一的关系，例如对于多种漏洞的处置防御策略均实质相同，此时可以将多个处置防御策略相同的漏洞标识均指向同一个playbook脚本，以节约存储空间。
在一种可能的实现方式中，分析和防御单元210通过读取资产和漏洞对应库206中存储的资产信息和漏洞标识之间的对应关系<资产型号、资产版本——漏洞标识1，……，漏洞标识N>，以及读取漏洞响应playbook单元208中存储的漏洞标识和playbook之间的对应关系，分析确定用于应急防御当前所分析资产中一个或多个漏洞的playbook脚本，并通过确定所述资产对应的所述网络设备的设备标识，确定将所述playbook脚本应用于所述设备标识所指示的所述网络设备。在另一种可能的实现方式中，分析和防御单元210通过读取资产和漏洞对应库206中存储的包括所述设备标识的全局资产标识和漏洞标识之间的对应关系<资产标识——漏洞标识1，……，漏洞标识N>，以及读取漏洞响应playbook单元208中存储的漏洞标识和playbook之间的对应关系，确定用于应急防御当前全局资产标识所对应资产中一个或多个漏洞的playbook脚本。
需要说明的是，当所述网络设备上需进行漏洞防御的资产具有多个时，分别确定用于防御每一个资产的一个或多个漏洞的playbook脚本。
在一种可能的实现方式中，分析和防御单元210可以基于所述网络设备的网络拓扑信息，确定需要应用所述playbook脚本执行漏洞防御策略的、与所述网络设备相关的一个或多个转发设备。分析和防御单元210可以基于所述资产对应的漏洞类型，确定用于执行漏洞防御策略的playbook脚本的发送对象是所述网络设备、与所述网络设备相关的转发设备、还是包括两者的全部。
在一种可能的实现方式中，所述漏洞标识与漏洞响应playbook脚本之间的对应关系，以及playbook的具体编排内容可由第三方提供和维护，也可以存储在云端或其他网络设备上以供漏洞管理设备204调用。所述playbook脚本用于解析后执行对所述网络设备资产的漏洞防御。
可选地，在本申请的另一实施例中，所述方法300还包括以下内容：
S320所述漏洞管理设备解析所述漏洞响应playbook得到所述漏洞防御策略，向所述网络设备发送所述漏洞防御策略。
在确定用于所述网络设备资产中一个或多个漏洞防御的一个或多个playbook脚本后，漏洞管理设备204解析所述一个或多个playbook脚本，以确定用于防御所述网络设备资产中的漏洞的一个或多个防御策略，并向所述网络设备或与所述网络设备相关的转发设备 发送所述一个或多个防御策略以执行。
可选地，在本申请的另一实施例中，可以不执行S320，而是作为替代执行S325，所述S325包括以下内容：
S325向所述网络设备或与所述网络设备相关的转发设备发送所述playbook脚本。
在此种情形下，漏洞管理设备204不执行所述playbook的解析操作，而是向相应的所述网络设备发送所述playbook的脚本，由所述网络设备侧执行所述脚本的解析操作，并按照解析后的漏洞防御策略执行相应操作。
本申请实施例还提供了一种漏洞管理设备400，如图4所示。所述设备400包括第一获取单元405、第二获取单元410和漏洞响应单元415。所述设备400例如可以是图2示出的漏洞管理设备204，或者是网管系统202或其他网络系统中集成的、能够实现相应漏洞防御功能的设备或单元等。
所述第一获取单元405，用于获取第一网络设备的资产的资产信息，所述资产信息包括资产标识、资产型号和资产版本，所述第一网络设备位于受控网络范围内。
所述资产信息例如可以从主机设备214和/或网络安全设备212获取。在一些可能的实现方式中，还可以一并获取与所述资产信息对应的设备标识。
所述第二获取单元410，用于基于所述资产信息中的资产型号和资产版本，获取与所述资产信息对应的漏洞信息。
所述资产信息和所述漏洞信息之间的对应关系可以保存在资产和漏洞对应库中，所述对应库可以保存在所述设备400内部，如图2示出的资产和漏洞对应库206，也可以保存在第三方设备中或者云端服务器等。所述资产和漏洞对应库可以由第三方负责更新和维护。第二获取单元410基于第一获取单元获取的所述资产信息，读取调用预先保存的资产信息和所述漏洞信息之间的对应关系，以获取与所述资产信息对应的所述漏洞信息。
第一确定单元415，用于确定与所述漏洞信息对应的漏洞响应剧本playbook，所述漏洞响应Playbook用于被解析后执行对所述第一网络设备的漏洞防御策略。
所述漏洞信息与所述漏洞响应playbook之间的对应关系可以保存在所述系统400内部，如图2示出的漏洞响应playbook单元208中，也可以保存在第三方设备中或者云端服务器等。各个所述漏洞信息与所述漏洞响应playbook之间的对应关系可以由第三方负责更新和维护。所述playbook用于编排针对所述网络设备资产的所述漏洞执行的漏洞防御策略脚本。
在一种可能的实施方式中，所述第二获取单元410获取与所述资产信息对应的漏洞信息，包括基于所述资产信息中所述资产型号和资产版本，在资产型号和资产版本的组合与漏洞信息的对应关系中，查找到与所述资产信息中所述资产型号和资产版本对应的漏洞信息。
在一种可能的实施方式中，所述第一确定单元415确定与所述漏洞信息对应的漏洞响应剧本playbook，包括：基于所述资产标识和漏洞信息的对应关系，以及所述漏洞信息和所述漏洞响应playbook的对应关系，确定所述资产信息中的所述资产标识对应的所述漏洞响应playbook；将确定出的所述漏洞响应playbook作为所述与所述漏洞信息对应的漏洞响应playbook。
所述第二获取单元410基于所述资产型号和资产版本的组合与漏洞信息的对应关系，以及所述资产信息中所述资产标识、资产型号和资产版本，确定所述资产标识和漏洞信息 的对应关系。
在一种可能的实现方式中，所述设备400还可以包括解析单元420和发送单元425，所述解析单元420用于解析所述漏洞响应playbook得到所述漏洞防御策略。所述发送单元425，用于基于与所述资产信息中的所述资产标识，向网络设备发送所述漏洞防御策略，以使得所述网络设备执行所述漏洞防御策略。所述资产标识可以是全局资产标识，也可以是局部资产标识。所述网络设备可以是例如图2示出的主机设备214、或网络安全设备212、或者与主机设备214或网络安全设备212相关的转发设备等。
在一种可能的实施例中，所述第一获取单元405和第二获取单元410可以是同一个获取单元，并用于执行所述单元405和410的相应功能。
本申请实施例还提供了一种漏洞管理设备500的结构示意图。所述设备500包括处理器501、存储器502和网络接口503。所述设备500例如可以是图2示出的漏洞管理设备204，或者图4示出的漏洞管理设备400。
网络接口503，用于接收来自网络设备的信息和/或向网络设备发送需要的信息。网络接口503可以将从网络接收到的信息发送给处理器501和/或存储器502，也可以向网络发送由处理器501处理或生成的信息。所述信息例如是资产的资产信息，或者playbook脚本等。网络接口503可以是有线接口，例如光纤分布式数据接口(Fiber Distributed Data Interface，FDDI)、千兆以太网(Gigabit Ethernet，GE)接口；网络接口503也可以是无线接口。
存储器502，用于存储计算机程序和数据。存储器502包括但不限于是随机存取存储器(random access memory，RAM)、只读存储器(Read only Memory，ROM)、可擦除可编程只读存储器(erasable programmable read-only memory，EPROM或者快闪存储器)、快闪存储器、或光存储器等。存储器502中保存有操作系统的代码。
处理器501可以是一个或多个CPU，该CPU可以是单核CPU，也可以是多核CPU。处理器501用于读取存储器502中存储的所述计算机程序和数据，并根据所述指令和数据执行前述实施例描述的安全漏洞防御方法300。
本申请实施例还提供一种计算机可读存储介质，所述存储介质上存储有计算机程序，所述计算机程序用于执行前述实施例描述的安全漏洞防御方法300。
应理解，在本申请的各种实施例中，除通过文字描述明确指定外，各过程的序号的大小并不意味着执行顺序的先后，各过程的执行顺序应以其功能和内在逻辑确定，而不应对本申请实施例的实施过程构成任何限定。
本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各示例的模块及方法步骤，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。这些功能究竟以何种实现方式来执行，取决于技术方案的特定应用和设计约束条件。本领域技术人员可以对每个特定的应用使用相应的方法来实现所描述的功能。例如，当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。所述计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行所述计算机程序指令时，全部或部分地产生按照本申请实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。
所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、 服务器或数据中心通过有线(例如同轴电缆、光纤、双绞线)或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质，(例如，软盘、硬盘、磁带)、光介质、或者半导体介质(例如固态硬盘Solid State Disk，(SSD))等。
本说明书的各个部分均采用递进的方式进行描述，各个方法和系统实施例之间相同相似的部分互相参见即可。尤其，对于部分系统实施例而言，由于其基本相似于方法实施例，所以描述的比较简单，相关之处参见方法实施例部分的说明即可。
上述实施例仅用以说明本申请的技术方案，而非对其限制。尽管参照上述实施例对本申请进行了详细的说明，本领域的普通技术人员还应当理解的是：任何基于对上述各实施例所记载的技术方案进行的改动、变形、或者对其中部分技术特征进行的等同替换均应属于本申请各实施例技术方案的范围。

Claims (19)

  1. 一种安全漏洞防御方法，其特征在于，所述方法包括：
    漏洞管理设备获取第一网络设备的资产的资产信息，所述资产信息包括资产标识、资产型号和资产版本，所述第一网络设备位于受控网络范围内；
    所述漏洞管理设备基于所述资产信息中的资产型号和资产版本，获取与所述资产信息对应的漏洞信息；
    所述漏洞管理设备确定与所述漏洞信息对应的漏洞响应剧本playbook，所述漏洞响应playbook用于被解析后执行对所述第一网络设备的漏洞防御策略。
  2. 如权利要求1所述的方法，其特征在于，所述获取与所述资产信息对应的漏洞信息，包括：
    所述漏洞管理设备基于所述资产信息中所述资产型号和资产版本，在资产型号和资产版本的组合与漏洞信息的对应关系中，查找到与所述资产信息中所述资产型号和资产版本对应的漏洞信息；
    所述漏洞管理设备基于所述资产型号和资产版本的组合与漏洞信息的对应关系，以及所述资产信息中所述资产标识、资产型号和资产版本，确定所述资产标识和漏洞信息的对应关系。
  3. 如权利要求2所述的方法，其特征在于，所述漏洞管理设备确定与所述漏洞信息对应的漏洞响应剧本playbook，包括：
    所述漏洞管理设备基于所述资产标识和漏洞信息的对应关系，以及所述漏洞信息和所述漏洞响应playbook的对应关系，确定所述资产信息中的所述资产标识对应的所述漏洞响应playbook；
    将确定出的所述漏洞响应playbook作为所述与所述漏洞信息对应的漏洞响应playbook。
  4. 如权利要求1至3任一所述的方法，其特征在于，所述方法还包括：
    所述漏洞管理设备解析所述漏洞响应playbook得到所述漏洞防御策略；
    所述漏洞管理设备基于与所述资产信息中的所述资产标识，向所述第一网络设备发送所述漏洞防御策略，以使得所述第一网络设备执行所述漏洞防御策略。
  5. 如权利要求4所述的方法，其特征在于，所述资产信息中的所述资产标识为全局资产标识，所述全局资产标识包括所述第一网络设备的设备标识，所述全局资产标识在所述受控网络范围内是唯一的，所述向所述第一网络设备发送所述漏洞防御策略之前，所述方法还包括：
    所述漏洞管理设备从所述全局资产标识中获取包括的所述第一网络设备的设备标识；
    所述向所述第一网络设备发送所述漏洞防御策略，具体为：根据所述第一网络设备的设备标识，向所述第一网络设备发送所述漏洞防御策略。
  6. 如权利要求1至3任一所述的方法，其特征在于，所述方法还包括：
    所述漏洞管理设备解析所述漏洞响应playbook得到所述漏洞防御策略；
    向与所述第一网络设备相关的转发设备发送所述漏洞防御策略，以使得与所述第一网络设备相关的转发设备执行所述漏洞防御策略。
  7. 如权利要求6所述的方法，其特征在于，所述向与所述第一网络设备相关的转发设备发送所述漏洞防御策略之前，所述方法还包括：
    所述漏洞管理设备获取所述第一网络设备的设备标识，以及所述受控网络的网络拓扑信息；
    所述漏洞管理设备基于所述网络拓扑信息，确定所述与所述第一网络设备相关的转发设备。
  8. 如权利要求7所述的方法，其特征在于，所述漏洞管理设备获取所述第一网络设备的设备标识，具体为：
    所述漏洞管理设备基于所述资产信息中的所述资产标识，获取所述第一网络设备的设备标识，其中，
    所述资产标识为全局资产标识，所述全局资产标识包括所述第一网络设备的所述设备标识，并且所述全局资产标识在所述受控网络范围内是唯一的，所述漏洞管理设备基于所述全局资产标识获取所述第一网络设备的所述设备标识，或者，所述资产标识为局部资产标识，并且所述局部资产标识在所述第一网络设备内是唯一的，所述漏洞管理设备基于所述局部资产标识和设备标识的对应关系，获取所述第一网络设备的设备标识。
  9. 如权利要求1-8任一所述的方法，其特征在于，所述漏洞防御策略包括基于访问控制列表ACL的访问控制策略、基于特征串的正则过滤策略、和/或入侵防护系统IPS防护签名策略。
  10. 一种漏洞管理设备，其特征在于，所述设备包括：
    第一获取单元，用于获取第一网络设备的资产的资产信息，所述资产信息包括资产标识、资产型号和资产版本，所述第一网络设备位于受控网络范围内；
    第二获取单元，用于基于所述资产信息中的资产型号和资产版本，获取与所述资产信息对应的漏洞信息；
    第一确定单元，用于确定与所述漏洞信息对应的漏洞响应剧本playbook，所述漏洞响应Playbook用于被解析后执行对所述第一网络设备的漏洞防御策略。
  11. 如权利要求10所述的漏洞管理设备，其特征在于，所述第二获取单元获取与所述资产信息对应的漏洞信息，包括：
    基于所述资产信息中所述资产型号和资产版本，在资产型号和资产版本的组合与漏洞信息的对应关系中，查找到与所述资产信息中所述资产型号和资产版本对应的漏洞信息；
    基于所述资产型号和资产版本的组合与漏洞信息的对应关系，以及所述资产信息中所述资产标识、资产型号和资产版本，确定所述资产标识和漏洞信息的对应关系。
  12. 如权利要求11所述的漏洞管理设备，其特征在于，所述第一确定单元确定与所述漏洞信息对应的漏洞响应剧本playbook，包括：
    基于所述资产标识和漏洞信息的对应关系，以及所述漏洞信息和所述漏洞响应playbook的对应关系，确定所述资产信息中的所述资产标识对应的所述漏洞响应playbook；
    将确定出的所述漏洞响应playbook作为所述与所述漏洞信息对应的漏洞响应playbook。
  13. 如权利要求10至12任一所述的漏洞管理设备，其特征在于，所述设备还包括：
    解析单元，用于解析所述漏洞响应playbook得到所述漏洞防御策略；
    发送单元，用于基于与所述资产信息中的所述资产标识，向所述第一网络设备发送所述漏洞防御策略，以使得所述第一网络设备执行所述漏洞防御策略。
  14. 如权利要求13所述的漏洞管理设备，其特征在于，所述资产信息中的所述资产标识为全局资产标识，所述全局资产标识包括所述第一网络设备的设备标识，所述全局资产标识在所述受控网络范围内是唯一的，所述发送单元向所述第一网络设备发送所述漏洞防御策略之前，所述设备还包括：
    所述第一获取单元从所述全局资产标识中获取包括的所述第一网络设备的设备标识；
    所述发送单元用于根据所述第一网络设备的设备标识，向所述第一网络设备发送所述漏洞防御策略。
  15. 如权利要求10至12任一所述的设备，其特征在于，所述漏洞管理设备还包括：
    解析单元，用于解析所述漏洞响应playbook得到所述漏洞防御策略；
    发送单元，用于向与所述第一网络设备相关的转发设备发送所述漏洞防御策略，以使得与所述第一网络设备相关的转发设备执行所述漏洞防御策略。
  16. 如权利要求15所述的设备，其特征在于，
    所述第一获取单元还用于所述发送单元向与所述第一网络设备相关的转发设备发送所述漏洞防御策略之前，获取所述第一网络设备的设备标识，以及所述受控网络的网络拓扑信息；
    所述漏洞管理设备还包括：第二确定单元，用于基于所述网络拓扑信息，确定与所述第一网络设备相关的所述转发设备。
  17. 如权利要求16所述的设备，其特征在于，所述第一获取单元获取所述第一网络设备的设备标识，具体为：
    基于所述资产信息中的所述资产标识，获取所述第一网络设备的所述设备标识，其中，
    所述资产标识为全局资产标识，所述全局资产标识包括所述第一网络设备的所述设备标识，并且所述全局资产标识在所述受控网络范围内是唯一的，所述第一获取单元基于所述全局资产标识获取所述第一网络设备的所述设备标识，或者，所述资产标识为局部资产 标识，并且所述局部资产标识在所述第一网络设备内是唯一的，所述第一获取单元基于所述局部资产标识和所述设备标识的对应关系，获取所述第一网络设备的所述设备标识。
  18. 一种漏洞管理设备，其特征在于，包括处理器和存储器，所述存储器用于存储计算机程序，所述处理器用于调用存储器中存储的计算机程序，执行如权利要求1-9任一所述的方法。
  19. 一种计算机可读存储介质，其特征在于，所述存储介质上存储有计算机程序，所述计算机程序用于执行权利要求1-9任一所述的方法。
PCT/CN2020/117834 2019-10-22 2020-09-25 一种安全漏洞的防御方法和设备 WO2021077987A1 (zh)

Priority Applications (3)

Application Number Priority Date Filing Date Title
EP20880280.1A EP4027604A4 (en) 2019-10-22 2020-09-25 METHOD AND DEVICE TO PROTECT AGAINST SECURITY VULNERABILITIES
JP2022521014A JP7299415B2 (ja) 2019-10-22 2020-09-25 セキュリティ脆弱性防御方法およびデバイス
US17/717,751 US20220239687A1 (en) 2019-10-22 2022-04-11 Security Vulnerability Defense Method and Device

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201911007623.0 2019-10-22
CN201911007623.0A CN112702300B (zh) 2019-10-22 2019-10-22 一种安全漏洞的防御方法和设备

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US17/717,751 Continuation US20220239687A1 (en) 2019-10-22 2022-04-11 Security Vulnerability Defense Method and Device

Publications (1)

Publication Number Publication Date
WO2021077987A1 true WO2021077987A1 (zh) 2021-04-29

Family

ID=75504706

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/117834 WO2021077987A1 (zh) 2019-10-22 2020-09-25 一种安全漏洞的防御方法和设备

Country Status (5)

Country Link
US (1) US20220239687A1 (zh)
EP (1) EP4027604A4 (zh)
JP (1) JP7299415B2 (zh)
CN (1) CN112702300B (zh)
WO (1) WO2021077987A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115086076A (zh) * 2022-07-21 2022-09-20 中国银行股份有限公司 一种零日漏洞攻击防御方法和系统、电子设备、存储介质

Families Citing this family (12)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113098902A (zh) * 2021-04-29 2021-07-09 深圳融安网络科技有限公司 网络设备漏洞管理方法、装置、管理终端设备及存储介质
CN113672934A (zh) * 2021-08-09 2021-11-19 中汽创智科技有限公司 一种安全漏洞扫描系统及方法、终端、存储介质
CN113987519A (zh) * 2021-11-05 2022-01-28 湖北天融信网络安全技术有限公司 漏洞规则库生成方法、装置、电子设备、存储介质及系统
US20230169175A1 (en) * 2021-11-29 2023-06-01 International Business Machines Corporation Managing Zero-Day Vulnerabilities
CN114157471A (zh) * 2021-11-29 2022-03-08 阿波罗智联(北京)科技有限公司 车辆异常的处理方法、装置、电子设备和介质
CN114584339A (zh) * 2021-12-29 2022-06-03 奇安信科技集团股份有限公司 基于内生安全机制的网络安全防护方法和装置
CN114584348A (zh) * 2022-02-14 2022-06-03 上海安锐信科技有限公司 一种基于漏洞的工业控制系统网络威胁分析方法
CN115174241B (zh) * 2022-07-14 2023-07-25 中汽创智科技有限公司 一种安全漏洞处理方法、装置、设备及介质
US11792233B1 (en) * 2022-08-07 2023-10-17 Uab 360 It Securing network devices against network vulnerabilities
CN116760716B (zh) * 2023-08-18 2023-11-03 南京天谷电气科技有限公司 一种新能源场站智能网络拓扑管理系统及方法
CN117319089B (zh) * 2023-11-27 2024-03-12 杭州海康威视数字技术股份有限公司 基于语义感知策略自生成的物联网自防御方法及装置
CN117708834B (zh) * 2024-02-06 2024-04-23 长扬科技(北京)股份有限公司 资产漏洞检测方法及装置

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102624717A (zh) * 2012-03-02 2012-08-01 深信服网络科技（深圳）有限公司 基于漏洞扫描的安全策略自动生成的方法及装置
WO2014048257A1 (en) * 2012-09-28 2014-04-03 Tencent Technology (Shenzhen) Company Limited Security protection system and method
CN105939311A (zh) * 2015-08-11 2016-09-14 杭州迪普科技有限公司 一种网络攻击行为的确定方法和装置
WO2018177210A1 (zh) * 2017-03-27 2018-10-04 新华三技术有限公司 防御apt攻击
CN109639720A (zh) * 2019-01-08 2019-04-16 平安科技（深圳）有限公司 漏洞最优改进策略确定方法、装置及存储介质、服务器
CN109818984A (zh) * 2019-04-10 2019-05-28 吉林亿联银行股份有限公司 漏洞的防御方法及装置

Family Cites Families (17)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9100431B2 (en) * 2003-07-01 2015-08-04 Securityprofiling, Llc Computer program product and apparatus for multi-path remediation
JP4688472B2 (ja) 2004-11-01 2011-05-25 株式会社エヌ・ティ・ティ・ドコモ 端末制御装置及び端末制御方法
US8095984B2 (en) * 2005-09-22 2012-01-10 Alcatel Lucent Systems and methods of associating security vulnerabilities and assets
US8549650B2 (en) * 2010-05-06 2013-10-01 Tenable Network Security, Inc. System and method for three-dimensional visualization of vulnerability and asset data
JP2012208863A (ja) 2011-03-30 2012-10-25 Hitachi Ltd 脆弱性判定システム、脆弱性判定方法、および、脆弱性判定プログラム
US8881289B2 (en) * 2011-10-18 2014-11-04 Mcafee, Inc. User behavioral risk assessment
US9467464B2 (en) * 2013-03-15 2016-10-11 Tenable Network Security, Inc. System and method for correlating log data to discover network vulnerabilities and assets
WO2015114791A1 (ja) 2014-01-31 2015-08-06 株式会社日立製作所 セキュリティ管理装置
CN105991595B (zh) 2015-02-15 2020-08-07 华为技术有限公司 网络安全防护方法及装置
US10135871B2 (en) 2015-06-12 2018-11-20 Accenture Global Solutions Limited Service oriented software-defined security framework
CN105592049B (zh) * 2015-09-07 2019-01-25 新华三技术有限公司 一种攻击防御规则的开启方法和装置
WO2017166047A1 (zh) * 2016-03-29 2017-10-05 华为技术有限公司 网络攻击防御策略发送、网络攻击防御的方法和装置
US11429473B2 (en) * 2016-11-30 2022-08-30 Red Hat, Inc. Automated problem resolution
US11843577B2 (en) * 2016-12-13 2023-12-12 Zscaler, Inc. Fingerprinting to identify devices and applications for use in management and policy in the cloud
US10542050B2 (en) * 2017-08-30 2020-01-21 General Electric Company Automated network security policy configuration
CN108494810B (zh) * 2018-06-11 2021-01-26 中国人民解放军战略支援部队信息工程大学 面向攻击的网络安全态势预测方法、装置及系统
US11995541B2 (en) * 2018-12-14 2024-05-28 Proofpoint, Inc. Systems and methods for location threat monitoring

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102624717A (zh) * 2012-03-02 2012-08-01 深信服网络科技（深圳）有限公司 基于漏洞扫描的安全策略自动生成的方法及装置
WO2014048257A1 (en) * 2012-09-28 2014-04-03 Tencent Technology (Shenzhen) Company Limited Security protection system and method
CN105939311A (zh) * 2015-08-11 2016-09-14 杭州迪普科技有限公司 一种网络攻击行为的确定方法和装置
WO2018177210A1 (zh) * 2017-03-27 2018-10-04 新华三技术有限公司 防御apt攻击
CN109639720A (zh) * 2019-01-08 2019-04-16 平安科技（深圳）有限公司 漏洞最优改进策略确定方法、装置及存储介质、服务器
CN109818984A (zh) * 2019-04-10 2019-05-28 吉林亿联银行股份有限公司 漏洞的防御方法及装置

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP4027604A4

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115086076A (zh) * 2022-07-21 2022-09-20 中国银行股份有限公司 一种零日漏洞攻击防御方法和系统、电子设备、存储介质

Also Published As

Publication number Publication date
US20220239687A1 (en) 2022-07-28
CN112702300B (zh) 2023-03-28
JP2022551140A (ja) 2022-12-07
EP4027604A4 (en) 2022-10-19
EP4027604A1 (en) 2022-07-13
JP7299415B2 (ja) 2023-06-27
CN112702300A (zh) 2021-04-23

Similar Documents

Publication Publication Date Title
WO2021077987A1 (zh) 一种安全漏洞的防御方法和设备
US11936666B1 (en) Risk analyzer for ascertaining a risk of harm to a network and generating alerts regarding the ascertained risk
US11489855B2 (en) System and method of adding tags for use in detecting computer attacks
US10929538B2 (en) Network security protection method and apparatus
US8839442B2 (en) System and method for enabling remote registry service security audits
CN113228585B (zh) 具有基于反馈回路的增强流量分析的网络安全系统
US20070226797A1 (en) Software vulnerability exploitation shield
US11863571B2 (en) Context profiling for malware detection
US20080256634A1 (en) Target data detection in a streaming environment
US11949694B2 (en) Context for malware forensics and detection
US11803647B2 (en) Computer system vulnerability lockdown mode
KR20120072120A (ko) 악성 파일 진단 장치 및 방법, 악성 파일 감시 장치 및 방법
USRE48043E1 (en) System, method and computer program product for sending unwanted activity information to a central system
WO2019152421A1 (en) Context profiling for malware detection
CN117278288A (zh) 一种网络攻击防护方法、装置、电子设备及存储介质
CN116846641A (zh) 一种漏洞防御方法、设备、系统及存储介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20880280

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2022521014

Country of ref document: JP

Kind code of ref document: A

ENP Entry into the national phase

Ref document number: 2020880280

Country of ref document: EP

Effective date: 20220406

NENP Non-entry into the national phase

Ref country code: DE